agentprime: CWE-620

CVE-2025-71457: vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

Wed, 04 Nov 2026 20:36:45 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-119429: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Fri, 30 Oct 2026 11:30:57 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-118984: OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

Thu, 29 Oct 2026 10:44:39 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2013-20008: Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

Wed, 28 Oct 2026 02:03:11 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-112002: ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

Sun, 18 Oct 2026 11:38:27 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97380: MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

Fri, 16 Oct 2026 16:23:07 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Gotify: Insufficiently Protected Password Change endpoint

Thu, 15 Oct 2026 20:15:38 GMT

github.com/gotify/server/v2 <=2.9.1, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-104106: FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification

Wed, 14 Oct 2026 20:36:27 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105785: Joplin Server password reset accepts tokens issued for unrelated purposes

Mon, 05 Oct 2026 23:12:45 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92467: microservices-platform through 6.0.0 Unverified Password Change via /users/password

Wed, 16 Sep 2026 13:16:43 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-91995: pig before 4.1.0 Unverified Password Change via /register/password

Tue, 15 Sep 2026 11:35:50 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86260: sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change

Mon, 07 Sep 2026 02:00:12 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85591: phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

Fri, 04 Sep 2026 11:29:56 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Thu, 03 Sep 2026 19:23:15 GMT

github.com/semaphoreui/semaphore <0.0.0-20260707190631-c59c3dc9035b, fixed in 0.0.0-20260707190631-c59c3dc9035b. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-77644: Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition

Thu, 20 Aug 2026 21:54:48 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Thu, 20 Aug 2026 18:38:30 GMT

backpack/crud >=6.0.0, <6.8.14 || >=7.0.0, <7.0.38, fixed in 6.8.14, 7.0.38. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Thu, 20 Aug 2026 18:38:26 GMT

backpack/crud <6.8.11 || >=7.0.0-alpha.1, <7.0.34, fixed in 6.8.11, 7.0.34. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-76633: WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

Thu, 20 Aug 2026 13:46:24 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-17599: Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

Fri, 07 Aug 2026 16:07:42 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15964: Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change

Sat, 01 Aug 2026 08:32:27 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Fri, 24 Jul 2026 21:54:55 GMT

poweradmin/poweradmin >=4.0.0, <4.2.5 || >=4.3.0, <4.3.4, fixed in 4.2.5, 4.3.4. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-12692: Improper Authentication in Vimesoft's Enterprise Video Platform

Fri, 17 Jul 2026 16:39:19 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-56305: Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

Fri, 10 Jul 2026 13:57:54 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54801: Siemens CPCI85 Central Processing/Communication: A vulnerability has been identified in CPCI85 Central Processing/Communication (All…

Thu, 09 Jul 2026 14:15:54 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-44733: OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements

Fri, 26 Jun 2026 19:47:13 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

Fri, 26 Jun 2026 17:33:35 GMT

org.openidentityplatform.openam:openam-auth-oauth2 <16.1.1, fixed in 16.1.1. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-5386: KMW CCTV Security Cameras Unverified Password Change

Fri, 29 May 2026 16:25:17 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9249: Devolutions Server: Unverified password change in Devolutions Server allows an attacker to change a user's…

Fri, 22 May 2026 15:24:48 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Concrete CMS has a session-hardening bypass and allows password change without reauthorization

Fri, 22 May 2026 00:31:16 GMT

concrete5/concrete5 <9.5.1, fixed in 9.5.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

Wed, 22 Apr 2026 22:13:10 GMT

openc3 <6.10.5 || >=7.0.0.pre.rc1, <7.0.0-rc3, fixed in 6.10.5, 7.0.0-rc3. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-40588: blueprintUE: Authenticated Password Change Does Not Verify Current Password

Tue, 21 Apr 2026 17:12:08 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2019-25653: Navicat for Oracle 12.1.15 Password Field Denial of Service

Mon, 30 Mar 2026 11:02:27 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-30458: An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

Thu, 26 Mar 2026 00:00:00 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-70082: Lantronix EDS3000PS Unverified Password Change

Wed, 11 Mar 2026 00:00:00 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-67041: Lantronix EDS3000PS OS Command Injection

Wed, 11 Mar 2026 00:00:00 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-27757: SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change

Fri, 27 Feb 2026 18:11:05 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-24443: EventSentry < 6.0.1.20 Web Reports Unverified Password Change

Tue, 24 Feb 2026 20:14:44 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-2543: vichan-devel vichan Password Change pages.php unverified password change

Mon, 16 Feb 2026 07:02:06 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-24440: Tenda W30E V2 Allows Password Changes Without Verifying Current Password

Mon, 26 Jan 2026 17:38:44 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14751: Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service

Thu, 22 Jan 2026 21:42:50 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-11235: MOVEit Transfer REST API does not require current password in order to initiate the password change process

Tue, 06 Jan 2026 22:16:48 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13148: IBM Aspera Orchestrator Unverified Password Change

Thu, 11 Dec 2025 19:48:18 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Ibexa User Bundle is missing password change validation

Wed, 10 Dec 2025 18:20:55 GMT

ibexa/user >=5.0.0-beta1, <5.0.4, fixed in 5.0.4. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-59808: Fortinet FortiSOAR on-premise: An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR…

Tue, 09 Dec 2025 17:19:06 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-63362: Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as bl…

Thu, 04 Dec 2025 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change

Fri, 14 Nov 2025 20:57:31 GMT

flowise-ui <3.0.10, fixed in 3.0.10. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)

Fri, 14 Nov 2025 20:56:02 GMT

flowise-ui <3.0.10, fixed in 3.0.10. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-61132: A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of…

Thu, 23 Oct 2025 00:00:00 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-62425: Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Thu, 16 Oct 2025 18:44:02 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-61536: FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme.

Thu, 16 Oct 2025 00:00:00 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.