# CWE-620.

Every Advisory and CVE whose sources give the weakness CWE-620, newest first.

## Records, newest first (an older page)

- [D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change](https://agentprime.io/advisories/CVE-2025-4903.md)
  `CVE-2025-4903` · CVE record: D-Link DI-7003GV2 · CVSS 6.9 Medium · Not analysed yet · Published 19 May 2025 · Tags: CWE-620, CWE-640
- [Unverified Password Change](https://agentprime.io/advisories/CVE-2025-46748.md)
  `CVE-2025-46748` · CVE record: Schweitzer Engineering Laboratories SEL Blueframe OS · CVSS 2.7 Low · Not analysed yet · Published 12 May 2025 · Tags: CWE-620
- [WormHole Tech GPM - Unverified Password Change](https://agentprime.io/advisories/CVE-2025-4558.md)
  `CVE-2025-4558` · CVE record: WormHole Tech GPM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2025 · Tags: CWE-620
- [ContiNew Admin password unverified password change](https://agentprime.io/advisories/CVE-2025-4552.md)
  `CVE-2025-4552` · CVE record: ContiNew Admin · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2025 · Tags: CWE-620, CWE-640
- [IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset](https://agentprime.io/advisories/CVE-2025-2253.md)
  `CVE-2025-2253` · CVE record: imithemes IMITHEMES Listing · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2025 · Tags: CWE-620
- [Unverified Password Change](https://agentprime.io/advisories/CVE-2024-47784.md)
  `CVE-2024-47784` · CVE record: ABB ANC and 2 more · CVSS 2.1 Low · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-620
- [Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update](https://agentprime.io/advisories/CVE-2025-3603.md)
  `CVE-2025-3603` · CVE record: v1rustyle Flynax Bridge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-620
- [Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update](https://agentprime.io/advisories/CVE-2025-3793.md)
  `CVE-2025-3793` · CVE record: lamarant Buddypress Force Password Change · CVSS 4.2 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-620
- [Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset](https://agentprime.io/advisories/CVE-2025-3607.md)
  `CVE-2025-3607` · CVE record: arkenon Login, Registration and Lost Password Blocks · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-620
- [YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change](https://agentprime.io/advisories/CVE-2025-3849.md)
  `CVE-2025-3849` · CVE record: YXJ2018 SpringBoot-Vue-OnlineExam · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: CWE-620, CWE-640
- [Fortinet FortiSwitch: A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote…](https://agentprime.io/advisories/CVE-2024-48887.md)
  `CVE-2024-48887` · CVE record: Fortinet FortiSwitch · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-620
- [A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).](https://agentprime.io/advisories/CVE-2024-41796.md)
  `CVE-2024-41796` · CVE record: Siemens SENTRON 7KT PAC1260 Data Manager · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-620
- [Improper Privilege Management in transformeroptimus/superagi](https://agentprime.io/advisories/CVE-2024-9431.md)
  `CVE-2024-9431` · CVE record: transformeroptimus transformeroptimus/superagi · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-620
- [Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update](https://agentprime.io/advisories/CVE-2024-13373.md)
  `CVE-2024-13373` · CVE record: scriptsbundle Exertio Framework · CVSS 8.1 High · Not analysed yet · Published 1 Mar 2025 · Tags: CWE-620
- [Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change](https://agentprime.io/advisories/CVE-2024-12824.md)
  `CVE-2024-12824` · CVE record: scriptsbundle Nokri – Job Board WordPress Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Mar 2025 · Tags: CWE-620
- [CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover](https://agentprime.io/advisories/CVE-2024-12860.md)
  `CVE-2024-12860` · CVE record: scriptsbundle CarSpot – Dealership Wordpress Classified Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2025 · Tags: CWE-620
- [Unverified password change vulnerability in Janto](https://agentprime.io/advisories/CVE-2025-1107.md)
  `CVE-2025-1107` · CVE record: Impronta Janto · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2025 · Tags: CWE-620
- [IBM Security Verify Access unverified password change](https://agentprime.io/advisories/CVE-2024-45647.md)
  `CVE-2024-45647` · CVE record: IBM Security Verify Access and 1 more · CVSS 5.6 Medium · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-620
- [Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset](https://agentprime.io/advisories/CVE-2024-13375.md)
  `CVE-2024-13375` · CVE record: spoonthemes Adifier System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jan 2025 · Tags: CWE-620
- [Insecure Password Change Function](https://agentprime.io/advisories/CVE-2024-28143.md)
  `CVE-2024-28143` · CVE record: Image Access GmbH Scan2Net · CVSS 8.4 High · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-620
- [OctoPrint has API key access in settings without reauthentication](https://agentprime.io/advisories/GHSA-cc6x-8cc7-9953.md)
  `GHSA-cc6x-8cc7-9953`, `CVE-2024-51493`, `PYSEC-2024-202` · PyPI `octoprint`: affected `<1.10.3`, fixed in `1.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: Authentication bypass, CWE-620
- [LevelOne WBR-6012: The LevelOne WBR-6012 router's web application has a vulnerability in its firmware…](https://agentprime.io/advisories/CVE-2024-33699.md)
  `CVE-2024-33699` · CVE record: LevelOne WBR-6012 · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 30 Oct 2024 · Tags: CWE-620
- [BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset](https://agentprime.io/advisories/CVE-2024-8794.md)
  `CVE-2024-8794` · CVE record: bookingalgorithms BA Book Everything · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2024 · Tags: CWE-620
- [Fortinet FortiManager: A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10…](https://agentprime.io/advisories/CVE-2024-21757.md)
  `CVE-2024-21757` · CVE record: Fortinet FortiManager and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-620
- [An issue in Hangzhou Xiongwei Technology Development Co., Ltd.](https://agentprime.io/advisories/CVE-2024-26520.md)
  `CVE-2024-26520` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jul 2024 · Tags: CWE-620
- [Siemens CPCI85 Central Processing/Communication: A vulnerability has been identified in CPCI85 Central Processing/Communication (All…](https://agentprime.io/advisories/CVE-2024-37998.md)
  `CVE-2024-37998` · CVE record: Siemens CPCI85 Central Processing/Communication and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-620
- [Cisco Smart Software Manager On-Prem: A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM…](https://agentprime.io/advisories/CVE-2024-20419.md)
  `CVE-2024-20419` · CVE record: Cisco Cisco Smart Software Manager On-Prem · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.81 · Not analysed yet · Published 17 Jul 2024 · Tags: CWE-620
- [An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism.](https://agentprime.io/advisories/CVE-2024-27715.md)
  `CVE-2024-27715` · CVE record · CVSS 8.2 High · Not analysed yet · Published 5 Jul 2024 · Tags: CWE-620
- [An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account pa...](https://agentprime.io/advisories/GHSA-j527-v579-m98h.md)
  `GHSA-j527-v579-m98h`, `CVE-2024-2213`, `PYSEC-2024-193` · PyPI `zenml`: affected `<0.56.3`, fixed in `0.56.3` · CVSS 3.3 Low · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-620
- [Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process](https://agentprime.io/advisories/GHSA-93x3-m7pw-ppqm.md)
  `GHSA-93x3-m7pw-ppqm`, `CVE-2024-34077`, `PKSA-vn99-1c14-x82z` · Packagist `mantisbt/mantisbt`: affected `<2.26.2`, fixed in `2.26.2` · CVSS 7.3 High · Not analysed yet · Published 13 May 2024 · Tags: CWE-305, CWE-620
- [OctoPrint Unverified Password Change via Access Control Settings](https://agentprime.io/advisories/GHSA-5626-pw9c-hmjr.md)
  `GHSA-5626-pw9c-hmjr`, `CVE-2024-23637`, `PYSEC-2024-29` · PyPI `octoprint`: affected `<1.10.0rc1`, fixed in `1.10.0rc1` · CVSS 4.2 Medium · Not analysed yet · Published 31 Jan 2024 · Tags: Authentication bypass, CWE-620
- [Poly VVX 601 Configuration File Import unverified password change](https://agentprime.io/advisories/CVE-2023-4465.md)
  `CVE-2023-4465` · CVE record: Poly Trio 8300 and 4 more · CVSS 2.7 Low · Not analysed yet · Published 29 Dec 2023 · Tags: CWE-620
- [Expired tokens can be renewed without validating the account password](https://agentprime.io/advisories/GHSA-9wgg-m99q-hhfc.md)
  `GHSA-9wgg-m99q-hhfc` · PyPI `emailproxy`: affected `<2023.12.19`, fixed in `2023.12.19` · CVSS 8.1 High · Not analysed yet · Published 19 Dec 2023 · Tags: CWE-620
- [UserPro <= 5.1.1 - Insecure Password Reset Mechanism](https://agentprime.io/advisories/CVE-2023-2449.md)
  `CVE-2023-2449` · CVE record: UserPro - Community and User Profile WordPress Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Nov 2023 · Tags: CWE-620
- [AppPresser <= 4.2.5 - Insecure Password Reset Mechanism](https://agentprime.io/advisories/CVE-2023-4214.md)
  `CVE-2023-4214` · CVE record: scottopolis AppPresser – Mobile App Framework · CVSS 8.1 High · Not analysed yet · Published 18 Nov 2023 · Tags: CWE-620
- [pimcore/admin-ui-classic-bundle Unverified Password Change](https://agentprime.io/advisories/GHSA-6f58-j323-6472.md)
  `GHSA-6f58-j323-6472`, `CVE-2023-5844`, `PKSA-qhpb-4nkm-4qn3` · Packagist `pimcore/admin-ui-classic-bundle`: affected `<1.2.0-RC1`, fixed in `1.2.0-RC1` · CVSS 4.3 Medium · Not analysed yet · Published 31 Oct 2023 · Tags: Authentication bypass, CWE-620
- [WP User Control <= 1.5.3 - Insecure Password Reset Mechanism](https://agentprime.io/advisories/CVE-2023-4915.md)
  `CVE-2023-4915` · CVE record: wmsedgar WP User Control · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2023 · Tags: CWE-620
- [Unverified Password Change in instantsoft/icms2](https://agentprime.io/advisories/CVE-2023-4381.md)
  `CVE-2023-4381` · CVE record: instantsoft instantsoft/icms2 · CVSS 4.3 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: CWE-620
- [Unverified Password Change in tsolucio/corebos](https://agentprime.io/advisories/CVE-2023-3069.md)
  `CVE-2023-3069` · CVE record: tsolucio tsolucio/corebos · CVSS 7.6 High · Not analysed yet · Published 2 Jun 2023 · Tags: CWE-620
- [Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism](https://agentprime.io/advisories/CVE-2023-2297.md)
  `CVE-2023-2297` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2023 · Tags: CWE-620
- [Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue](https://agentprime.io/advisories/CVE-2023-25931.md)
  `CVE-2023-25931` · CVE record: Medtronic InsterStim Applications · CVSS 6.4 Medium · Not analysed yet · Published 1 Mar 2023 · Tags: CWE-620
- [Unverified Password Change in phpfusion/phpfusion](https://agentprime.io/advisories/CVE-2022-3152.md)
  `CVE-2022-3152` · CVE record: phpfusion phpfusion/phpfusion · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2022 · Tags: CWE-620
- [Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.](https://agentprime.io/advisories/GHSA-39gf-864w-pxw4.md)
  `GHSA-39gf-864w-pxw4`, `CVE-2022-2930`, `PYSEC-2022-43142` · PyPI `octoprint`: affected `<1.8.3`, fixed in `1.8.3` · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2022 · Tags: CWE-620
- [Metasys password guessing](https://agentprime.io/advisories/CVE-2022-21935.md)
  `CVE-2022-21935` · CVE record: Johnson Controls Metasys ADS/ADX/OAS server · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2022 · Tags: CWE-620
- [Metasys Unverified Password Change](https://agentprime.io/advisories/CVE-2022-21934.md)
  `CVE-2022-21934` · CVE record: Johnson Controls Metasys ADS/ADX/OAS server · CVSS 8.0 High · Not analysed yet · Published 6 May 2022 · Tags: CWE-620
- [Cisco BroadWorks CommPilot Application Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-34786.md)
  `CVE-2021-34786` · CVE record: Cisco Cisco BroadWorks · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-620
- [Cisco BroadWorks CommPilot Application Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-34785.md)
  `CVE-2021-34785` · CVE record: Cisco Cisco BroadWorks · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-620
- [EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…: A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 /…](https://agentprime.io/advisories/CVE-2021-22773.md)
  `CVE-2021-22773` · CVE record: EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) · No CVSS score · Not analysed yet · Published 21 Jul 2021 · Tags: CWE-620
- [CRIXP OpenCRX Unverified Password Change](https://agentprime.io/advisories/CVE-2020-7378.md)
  `CVE-2020-7378` · CVE record: CRIXP OpenCRX · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Nov 2020 · Tags: CWE-620
- [Synology DiskStation Manager (DSM): Unverified password change vulnerability in Change Password in Synology DiskStation…](https://agentprime.io/advisories/CVE-2018-8916.md)
  `CVE-2018-8916` · CVE record: Synology DiskStation Manager (DSM) · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2018 · Tags: CWE-620
- [ProMinent MultiFLEX M10a Controller: An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller…](https://agentprime.io/advisories/CVE-2017-14005.md)
  `CVE-2017-14005` · CVE record: ProMinent MultiFLEX M10a Controller · No CVSS score · Not analysed yet · Published 17 Oct 2017 · Tags: CWE-620

Newest: <https://agentprime.io/advisories/tag/cwe-620.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-620&cursor=WyIyMDI1LTA1LTIwVDA1OjMwOjQ4LjE0NzAwMFoiLCJDVkUtMjAyNS00MzIyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-620/?cursor=WyIyMDI1LTA1LTIwVDA1OjMwOjQ4LjE0NzAwMFoiLCJDVkUtMjAyNS00MzIyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.