CVE-2026-96258: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

CVE-2026-84168: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

PT-2026-97152

Name of the Vulnerable Software and Affected Versions onSite internet GmbH Auktion NG Auktionssoftware versions prior to 20260722 Description A remote cross site scripting issue exists within the Public Password Reset Endpoint component. The flaw occurs in the /forgotpasswd.html endpoint when the...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92930

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 (and versions dating back to at least 2.2.3.4 ) contains a vulnerability in the administrator password-reset unlock-code design. Because the system lacks a per-device secret or server-side cryptographic material, an attacker with physic...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-92928

The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-93556

Tankuam Places by Kompini is affected by an Insecure Direct Object Reference (IDOR) in the /password/guardarClau/recover endpoint. The endpoint accepts a usuariId parameter to specify which account's password to change, but the JWT token used in the recovery process is not validated against that ...

PT-2026-96691

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The '/password/guardarClau/recover' endpoint accepts the usuariId parameter to specify the account for a password change. The system fails to validate the JSON W...

PT-2026-97113

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder NVR versions 2.2.3.4 through 3.2.9.376 Description The administrator password-reset unlock-code design lacks a per-device secret or server-side cryptographic material. An attacker with physical-console acces...

PT-2026-97111

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description The firmware contains a hardcoded, undocumented recovery account with shared credentials that cannot be modified, disabled, or rotated. An unauthenticated remot...

CVE-2026-93556: Authorization Bypass Through User-Controlled Key

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the...

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340

Gladys Assistant before version 5.1.0 is affected by a password reset link poisoning vulnerability in the forgot_password endpoint. The root cause is the server's acceptance of a client-supplied origin parameter without validation , allowing an unauthenticated remote attacker to craft a request w...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-94412

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value,...

CVE-2026-94412

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint (UserController.java). An authenticated attacker can submit a request with an arbitrary target user ID, resetting that account's password to a known default value and enabling unauthorized access...