Weak Password Recovery Mechanism for Forgotten Password

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via the updatePassword function. An attacker can enumerate valid user accounts and forcibly chan...

PT-2024-30299

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.4 Description The issue is related to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowin...

PT-2021-21632

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue arises from the nickname variable not being properly sanitized before being displayed on a page. An attacker can exploit this by using the update password function to inject XSS payloads into...