20466 matches found
CVE-2025-15030 User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
CVE-2025-15030
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
CVE-2025-15030
The User Profile Builder WordPress plugin, in versions before 3.15.2 , contains a critical vulnerability due to an improper password reset process . The root cause is that the action2=recover_password2 flow fails to properly validate reset keys or enforce token expiration. An unauthenticated atta...
EUVD-2025-206614
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
CVE-2025-15030 User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
📄 Appsmith 1.92 Origin Header Injection
A critical vulnerability in Appsmith version 1.92 allows an unauthenticated attacker to manipulate the Origin HTTP header during the password reset process. Due to improper trust in client‑supplied headers, Appsmith constructs password reset links based on the injected origin. This enables an...
PT-2026-5609
Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 3.15.2 Description The User Profile Builder WordPress plugin does not have a secure password reset process. This allows unauthenticated requests to reset the password for any user,...
PT-2026-5616
Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...
WordPress plugin User Profile Builder 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
Lunary 安全漏洞
Lunary is an open-source production toolkit for LLMs developed by Lunary. Version 1.2.2 of Lunary contains a security vulnerability, which stems from the leakage of password reset tokens, potentially leading to account hijacking...
PT-2026-5615
Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...
Cybozu Garoon 跨站脚本漏洞
Cybozu Garoon is a portal-based OA office system developed by Cybozu. This system provides functions such as portals, email, bookmarks, calendar management, bulletin boards, and file management. Versions of Cybozu Garoon from 5.15.0 to 6.0.3 had a cross-site scripting vulnerability. This...
CVE-2026-22881: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...
CVE-2025-15030: Improper Privilege Management
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
CVE-2026-20711: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...
CVE-2024-5386: Excessive Attack Surface
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
Cybozu Garoon 跨站脚本漏洞
Cybozu Garoon is a portal-based OA office system developed by the Cybozu company. This system provides functions such as portals, email, bookmarks, calendar management, bulletin boards, and file management. Cybozu Garoon 6.0.3 and earlier versions had a cross-site scripting vulnerability. This...
PT-2026-6301
Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.28.5.0 Description CI4MS, a CodeIgniter 4-based CMS skeleton, contains a flaw in its authentication implementation that allows an unauthenticated attacker to determine if an email address is registered within the...
Innomic VibroLine Series 安全漏洞
The Innomic VibroLine Series is a professional vibration measurement and analysis system developed by the German company Innomic. The Innomic VibroLine Series has a security vulnerability: local attackers can reset the device’s password using an invalid reset file via USB, resulting in the comple...