WordPress Ace User Management plugin does not properly validate password reset token vulnerability

WordPress Ace User Management plugin is a WordPress user management plugin developed by Acewebx, mainly used to enhance and customize WordPress user roles, permissions and management features. WordPress Ace User Management plugin suffers from an improperly validated password reset token...

CVE-2025-62261

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to...

Account Takeover

Flowise is vulnerable to Account Takeover. The vulnerability is due to the forgot-password endpoint returning a valid password reset tempToken without authentication or verification, which allows an attacker to generate reset tokens for arbitrary users and reset their passwords...

CVE-2025-61541

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality forgotsend.cgi. The reset link sent to users is constructed using the HTTP Host header via getwebminemailurl. An attacker can manipulate the Host header to inject a malicious domain into the reset email. If ...

PT-2025-42477

Name of the Vulnerable Software and Affected Versions Webmin version 2.510 Description Webmin version 2.510 has a flaw in the password reset functionality forgot send.cgi. The reset link sent to users is created using the HTTP Host header through the get webmin email url function. An attacker can...

EUVD-2021-23493

Malware in sbrugna...

EUVD-2024-46758

Malicious code in bioql PyPI...

EUVD-2024-39453

Malicious code in bioql PyPI...

EUVD-2022-3452

Malicious code in bioql PyPI...

EUVD-2022-53415

Malicious code in bioql PyPI...

EUVD-2022-47867

Malicious code in bioql PyPI...

EUVD-2024-39454

Malicious code in bioql PyPI...

EUVD-2024-46513

Malicious code in bioql PyPI...

EUVD-2025-29069

Malicious code in bioql PyPI...

EUVD-2024-48544

Malicious code in bioql PyPI...

User Enumeration

prestashop/prestashop is vulnerable to User Enumeration. The vulnerability is due to insufficient validation of the idemployee and resettoken parameters due to the back-office accepting manipulated values without proper authentication or checks; an unauthenticated attacker can craft requests to t...

Flowise Access Control Error Vulnerability

Flowise is a FlowiseAI open source tool for easily building LLM applications. An Access Control Error vulnerability exists in Flowise 3.0.5 and prior versions, which stems from the forgot-password endpoint returning a password reset token without authentication, and can be exploited by an attacke...

CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...

GHSA-WGPV-6J63-X5PH Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

Summary The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account...

CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...