CVE-2025-8119

PAD CMS is affected by a Cross-Site Request Forgery in the reset password flow. A malicious site can cause a logged-in user to trigger a password change to a value chosen by the attacker, affecting all templates (www, bip, www+bip). The product is End-Of-Life and no patches will be published. Con...

CVE-2025-8117

Technical details for CVE-2025-8117 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this...

CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this...

CVE-2025-56234

ATNA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC ATNA2000 has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-56132

LiquidFiles pre-4.2 is affected by a user-enumeration vulnerability in the password reset flow. Distinguishable responses to valid vs. invalid emails allow unauthenticated attackers to enumerate registered users. Upgrading to 4.2+ remedies this with user-based lockout and less informative errors;...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

PT-2025-40021

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 4.2 Description The application exhibits a user enumeration issue in its password reset functionality. An unauthenticated attacker can determine the existence of user accounts by observing distinguishable response...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset feature. The reset token is not correctly bound to the requesting account and may be accepted for other user emails during login, allowing an attacker to log in as any user and potentially escalate privile...

PT-2025-39968

Name of the Vulnerable Software and Affected Versions PAD CMS affected versions not specified Description The software is susceptible to a Cross-Site Request Forgery CSRF issue within the password reset functionality. A malicious actor could create a specially crafted website that, when visited b...

Liquidfiles 安全漏洞

Liquidfiles is a storage service for large, secure file transfers and sharing for companies and organizations from US-based Liquidfiles, Inc. A security vulnerability exists in Liquidfiles versions prior to 4.2, which stems from the password reset feature returning distinguishable responses that...

PT-2025-40002

Name of the Vulnerable Software and Affected Versions TitanSystems Zender version 3.9.7 Description TitanSystems Zender version 3.9.7 has an account takeover issue in its password reset feature. A temporary password or reset token for one user can be used to log in as another user because of...

TitanSystems Zender 安全漏洞

TitanSystems Zender is a messaging gateway software from TitanSystems Philippines. A security vulnerability exists in TitanSystems Zender version 3.9.7, which stems from improper validation of the token-user association in the password reset feature, which could lead to account takeover and...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

Polska Akademia Dostępności CMS 跨站请求伪造漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A cross-site request forgery vulnerability exists in Polska Akademia Dostępności CMS, which stems from the reset password feature being vulnerable to cross-site request forgery...

CVE-2025-56676

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain...

Polska Akademia Dostępności CMS 安全漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A security vulnerability exists in Polska Akademia Dostępności CMS that stems from a weak client-side brute force protection mechanism that can be bypassed by an attacker by...

PT-2025-39957

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94 Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the change password function within the customer cabinet change...

CVE-2025-59934

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs jwt.decode without verifying their signatures. Both the email verification token login path...