CVE-2025-8119

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue...

CVE-2025-7052

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the changepassword function of its customercabinetchangepassword AJAX route. The plugin hooks this endpoint via wpajax and...

CVE-2025-8119 Cross-Site Request Forgery in PAD CMS

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue...

CVE-2025-8119 Cross-Site Request Forgery in PAD CMS

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue...

CVE-2025-8119

PAD CMS is affected by a Cross-Site Request Forgery in the reset password flow. A malicious site can cause a logged-in user to trigger a password change to a value chosen by the attacker, affecting all templates (www, bip, www+bip). The product is End-Of-Life and no patches will be published. Con...

CVE-2025-8117

Technical details for CVE-2025-8117 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this...

CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this...

CVE-2025-56234

ATNA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC ATNA2000 has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset feature. The reset token is not correctly bound to the requesting account and may be accepted for other user emails during login, allowing an attacker to log in as any user and potentially escalate privile...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-56132

LiquidFiles pre-4.2 is affected by a user-enumeration vulnerability in the password reset flow. Distinguishable responses to valid vs. invalid emails allow unauthenticated attackers to enumerate registered users. Upgrading to 4.2+ remedies this with user-based lockout and less informative errors;...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

PT-2025-40021

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 4.2 Description The application exhibits a user enumeration issue in its password reset functionality. An unauthenticated attacker can determine the existence of user accounts by observing distinguishable response...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

TitanSystems Zender 安全漏洞

TitanSystems Zender is a messaging gateway software from TitanSystems Philippines. A security vulnerability exists in TitanSystems Zender version 3.9.7, which stems from improper validation of the token-user association in the password reset feature, which could lead to account takeover and...

PT-2025-40002

Name of the Vulnerable Software and Affected Versions TitanSystems Zender version 3.9.7 Description TitanSystems Zender version 3.9.7 has an account takeover issue in its password reset feature. A temporary password or reset token for one user can be used to log in as another user because of...

PT-2025-39968

Name of the Vulnerable Software and Affected Versions PAD CMS affected versions not specified Description The software is susceptible to a Cross-Site Request Forgery CSRF issue within the password reset functionality. A malicious actor could create a specially crafted website that, when visited b...

Polska Akademia Dostępności CMS 跨站请求伪造漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A cross-site request forgery vulnerability exists in Polska Akademia Dostępności CMS, which stems from the reset password feature being vulnerable to cross-site request forgery...

Polska Akademia Dostępności CMS 安全漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A security vulnerability exists in Polska Akademia Dostępności CMS that stems from a weak client-side brute force protection mechanism that can be bypassed by an attacker by...