CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this...

CVE-2025-56234

ATNA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC ATNA2000 has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within...

CVE-2025-56132: Authentication Bypass by Primary Weakness

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-56676: Improper Restriction of Security Token Assignment

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

CVE-2025-8119: Cross-Site Request Forgery (CSRF)

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue...

PT-2025-39957

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94 Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the change password function within the customer cabinet change...

PT-2025-39968

Name of the Vulnerable Software and Affected Versions PAD CMS affected versions not specified Description The software is susceptible to a Cross-Site Request Forgery CSRF issue within the password reset functionality. A malicious actor could create a specially crafted website that, when visited b...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

CVE-2025-56676

TitanSystems Zender v3.9.7 is vulnerable to an account takeover vulnerability within its password reset functionality. The root cause is the improper validation of token-user linkage , where a reset token or temporary password issued to one user is not correctly bound to their specific account. C...

PT-2025-40002

Name of the Vulnerable Software and Affected Versions TitanSystems Zender version 3.9.7 Description TitanSystems Zender version 3.9.7 has an account takeover issue in its password reset feature. A temporary password or reset token for one user can be used to log in as another user because of...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-56132

The LiquidFiles filetransfer server (versions prior to 4.2 ) is vulnerable to user enumeration via its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses at the POST /password_reset endpoint. Specifically, while a redirect is issu...

PT-2025-40021

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 4.2 Description The application exhibits a user enumeration issue in its password reset functionality. An unauthenticated attacker can determine the existence of user accounts by observing distinguishable response...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

Polska Akademia Dostępności CMS Security Vulnerability

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A security vulnerability exists in Polska Akademia Dostępności CMS that stems from a weak client-side brute force protection mechanism that can be bypassed by an attacker by...

Polska Akademia Dostępności CMS Cross-Site Request Forgery Vulnerability

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A cross-site request forgery vulnerability exists in Polska Akademia Dostępności CMS, which stems from the reset password feature being vulnerable to cross-site request forgery...

TitanSystems Zender security vulnerability

TitanSystems Zender is a messaging gateway software from TitanSystems Philippines. A security vulnerability exists in TitanSystems Zender version 3.9.7, which stems from improper validation of the token-user association in the password reset feature, which could lead to account takeover and...

Liquidfiles security vulnerabilities

Liquidfiles is a storage service for large, secure file transfers and sharing for companies and organizations from US-based Liquidfiles, Inc. A security vulnerability exists in Liquidfiles versions prior to 4.2, which stems from the password reset feature returning distinguishable responses that...

CVE-2025-59934

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs jwt.decode without verifying their signatures. Both the email verification token login path...