# CWE-640.

Every Advisory and CVE whose sources give the weakness CWE-640, newest first.

## Records, newest first (an older page)

- [Beehive Forum - Account Takeover](https://agentprime.io/advisories/CVE-2022-50910.md)
  `CVE-2022-50910` · CVE record: Beehive Forum Beehive Forum · CVSS 8.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-640
- [A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a re…](https://agentprime.io/advisories/CVE-2025-63314.md)
  `CVE-2025-63314` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-640
- [Uasoft badaso Token BadasoAuthController.php forgetPassword password recovery](https://agentprime.io/advisories/CVE-2025-15398.md)
  `CVE-2025-15398` · CVE record: Uasoft badaso · CVSS 6.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-640
- [Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect](https://agentprime.io/advisories/CVE-2025-14783.md)
  `CVE-2025-14783` · CVE record: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy · CVSS 4.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-640
- [LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header](https://agentprime.io/advisories/CVE-2023-53958.md)
  `CVE-2023-53958` · CVE record: ltb-project LDAP Tool Box Self Service Password · CVSS 8.6 High · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-640
- [KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlle…](https://agentprime.io/advisories/CVE-2025-65203.md)
  `CVE-2025-65203` · CVE record · CVSS 7.1 High · Not analysed yet · Published 17 Dec 2025 · Tags: Cross-site request forgery (CSRF), CWE-353, CWE-640
- [Shenzhen Sixun Software Sixun Shanghui Group Business Management System UpdatePasswordBatch password recovery](https://agentprime.io/advisories/CVE-2025-14696.md)
  `CVE-2025-14696` · CVE record: Shenzhen Sixun Software Sixun Shanghui Group Business Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: CWE-640
- [Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition](https://agentprime.io/advisories/GHSA-95fv-5gfj-2r84.md)
  `GHSA-95fv-5gfj-2r84`, `CVE-2025-64113` · NuGet `MediaBrowser.Server.Core`: affected `<4.9.1.81`, fixed in `4.9.1.81` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-640
- [MAXHUB Pivot Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/CVE-2025-53704.md)
  `CVE-2025-53704` · CVE record: MAXHUB Pivot client application · CVSS 8.7 High · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-640
- [Host header poisoning allows account takeover via password reset email](https://agentprime.io/advisories/CVE-2024-32642.md)
  `CVE-2024-32642` · CVE record: MasaCMS MasaCMS · CVSS 8.8 High · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-346, CWE-640
- [An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.](https://agentprime.io/advisories/CVE-2025-50433.md)
  `CVE-2025-50433` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2025 · Tags: CWE-640
- [SourceCodester Inventory Management System resetPassword.php password recovery](https://agentprime.io/advisories/CVE-2025-13565.md)
  `CVE-2025-13565` · CVE record: SourceCodester Inventory Management System · CVSS 6.9 Medium · Not analysed yet · Published 23 Nov 2025 · Tags: CWE-640
- [ClipBucket v5 is vulnerable to password reset link manipulation](https://agentprime.io/advisories/CVE-2025-62709.md)
  `CVE-2025-62709` · CVE record: MacWarrior clipbucket-v5 · CVSS 6.8 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-640
- [Piwigo is vulnerable to one-click account takeover by modifying the password-reset link](https://agentprime.io/advisories/CVE-2025-62406.md)
  `CVE-2025-62406` · CVE record: Piwigo Piwigo · CVSS 8.1 High · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-640
- [Shopware 6's password recovery link does not expire after email change](https://agentprime.io/advisories/GHSA-2w46-vq8h-98vh.md)
  `GHSA-2w46-vq8h-98vh`, `PKSA-w3qy-s9h7-2hqr` · Packagist `shopware/core`: affected `<6.6.10.9 || >=6.7.0.0, <6.7.4.1`, fixed in `6.6.10.9`, `6.7.4.1` · CVSS 5.0 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: CWE-640
- [2FA Expiry Bypass in Optimus Software's Brokerage Automation](https://agentprime.io/advisories/CVE-2025-8855.md)
  `CVE-2025-8855` · CVE record: Optimus Software Brokerage Automation · CVSS 8.1 High · Not analysed yet · Published 14 Nov 2025 · Tags: Broken access control, CWE-302, CWE-640
- [Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism](https://agentprime.io/advisories/CVE-2025-12866.md)
  `CVE-2025-12866` · CVE record: Hundred Plus EIP Plus · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Nov 2025 · Tags: CWE-640
- [ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection](https://agentprime.io/advisories/GHSA-mwmh-7px9-4c23.md)
  `GHSA-mwmh-7px9-4c23`, `CVE-2025-64101`, `GO-2025-4084` · Go `github.com/zitadel/zitadel/v2`: affected `<1.80.0-v2.20.0.20251029090537-72a5c33e6ac3 || >=2.0.0, <2.71.18`, fixed in `1.80.0-v2.20.0.20251029090537-72a5c33e6ac3`, `2.71.18` · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2025 · Tags: Open redirect, CWE-640
- [AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/CVE-2025-61977.md)
  `CVE-2025-61977` · CVE record: AutomationDirect Productivity Suite and 4 more · CVSS 7.3 High · Not analysed yet · Published 23 Oct 2025 · Tags: CWE-640
- [Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tok…](https://agentprime.io/advisories/CVE-2025-56748.md)
  `CVE-2025-56748` · CVE record · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: CWE-640
- [Weak password recovery vulnerability](https://agentprime.io/advisories/CVE-2025-41251.md)
  `CVE-2025-41251` · CVE record: vmware NSX · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-640
- [Wavlink WL-WN578W2 sysinit.html password recovery](https://agentprime.io/advisories/CVE-2025-10322.md)
  `CVE-2025-10322` · CVE record: Wavlink WL-WN578W2 · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: CWE-640
- [Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/CVE-2025-10127.md)
  `CVE-2025-10127` · CVE record: Daikin Europe N.V Security Gateway · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-640
- [WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2025-32486.md)
  `CVE-2025-32486` · CVE record: Hossein Material Dashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-640
- [A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism.](https://agentprime.io/advisories/CVE-2025-50503.md)
  `CVE-2025-50503` · CVE record · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-640
- [Content-Disposition headers incorrectly ignored for some MIME types](https://agentprime.io/advisories/CVE-2025-55030.md)
  `CVE-2025-55030` · CVE record: Mozilla Firefox for iOS · CVSS 6.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-640
- [An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account pass…](https://agentprime.io/advisories/CVE-2025-50594.md)
  `CVE-2025-50594` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-640
- [jshERP updatePwd password recovery](https://agentprime.io/advisories/CVE-2025-7948.md)
  `CVE-2025-7948` · CVE record: jshERP · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-640
- [Mercusys MW301R Web Interface password recovery](https://agentprime.io/advisories/CVE-2025-7881.md)
  `CVE-2025-7881` · CVE record: Mercusys MW301R · CVSS 5.1 Medium · Not analysed yet · Published 20 Jul 2025 · Tags: CWE-640
- [IBM Engineering Requirements Management DOORS weak authentication](https://agentprime.io/advisories/CVE-2024-43190.md)
  `CVE-2024-43190` · CVE record: IBM Engineering Requirements Management DOORS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-640
- [Natours has a 1 Click Account take over on reset password via Host Header injection](https://agentprime.io/advisories/CVE-2025-53373.md)
  `CVE-2025-53373` · CVE record: ahmed-elgaml11 Natours · CVSS 8.9 High · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-640
- [JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.](https://agentprime.io/advisories/CVE-2025-43932.md)
  `CVE-2025-43932` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-640
- [flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.](https://agentprime.io/advisories/CVE-2025-43931.md)
  `CVE-2025-43931` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-640
- [Kanboard Password Reset Poisoning via Host Header Injection](https://agentprime.io/advisories/CVE-2025-52560.md)
  `CVE-2025-52560` · CVE record: kanboard kanboard · CVSS 8.1 High · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-640
- [Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-6216.md)
  `CVE-2025-6216` · CVE record: Allegra Allegra · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 21 Jun 2025 · Tags: CWE-640
- [UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change](https://agentprime.io/advisories/CVE-2025-6097.md)
  `CVE-2025-6097` · CVE record: UTT 进取 750W · CVSS 6.9 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: CWE-620, CWE-640
- [WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability](https://agentprime.io/advisories/CVE-2025-47646.md)
  `CVE-2025-47646` · CVE record: Gilblas Ngunte Possi PSW Front-end Login & Registration · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 23 May 2025 · Tags: CWE-640
- [D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change](https://agentprime.io/advisories/CVE-2025-4903.md)
  `CVE-2025-4903` · CVE record: D-Link DI-7003GV2 · CVSS 6.9 Medium · Not analysed yet · Published 19 May 2025 · Tags: CWE-620, CWE-640
- [ContiNew Admin password unverified password change](https://agentprime.io/advisories/CVE-2025-4552.md)
  `CVE-2025-4552` · CVE record: ContiNew Admin · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2025 · Tags: CWE-620, CWE-640
- [YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change](https://agentprime.io/advisories/CVE-2025-3849.md)
  `CVE-2025-3849` · CVE record: YXJ2018 SpringBoot-Vue-OnlineExam · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: CWE-620, CWE-640
- [WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability](https://agentprime.io/advisories/CVE-2025-31380.md)
  `CVE-2025-31380` · CVE record: videowhisper Paid Videochat Turnkey Site · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2025 · Tags: CWE-640
- [BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password](https://agentprime.io/advisories/CVE-2024-12295.md)
  `CVE-2024-12295` · CVE record: PX-lab BoomBox Theme Extensions · CVSS 8.8 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-640
- [Account Takeover Vulnerability in CAP back office application](https://agentprime.io/advisories/CVE-2025-29995.md)
  `CVE-2025-29995` · CVE record: Rising Technosoft CAP back office application · CVSS 8.3 High · Not analysed yet · Published 13 Mar 2025 · Tags: CWE-640
- [Improper Authentication in Tapandsign Technologies Tap and Sign App](https://agentprime.io/advisories/CVE-2024-12604.md)
  `CVE-2024-12604` · CVE record: Tapandsign Technologies Tap&Sign App · CVSS 6.5 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-526, CWE-640
- [PHPGurukul Online Library Management System change-password.php password recovery](https://agentprime.io/advisories/CVE-2025-2093.md)
  `CVE-2025-2093` · CVE record: PHPGurukul Online Library Management System · CVSS 2.3 Low · Not analysed yet · Published 7 Mar 2025 · Tags: CWE-640
- [Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP](https://agentprime.io/advisories/CVE-2025-1570.md)
  `CVE-2025-1570` · CVE record: wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 8.1 High · Not analysed yet · Published 28 Feb 2025 · Tags: CWE-640
- [YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery](https://agentprime.io/advisories/CVE-2025-0331.md)
  `CVE-2025-0331` · CVE record: YunzMall · CVSS 6.9 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-640
- [AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover](https://agentprime.io/advisories/CVE-2024-11350.md)
  `CVE-2024-11350` · CVE record: scriptsbundle AdForest · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-640
- [CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.](https://agentprime.io/advisories/CVE-2024-53552.md)
  `CVE-2024-53552` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-640
- [Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/CVE-2024-47547.md)
  `CVE-2024-47547` · CVE record: Ruijie Reyee OS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-640
- [Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover](https://agentprime.io/advisories/CVE-2024-11103.md)
  `CVE-2024-11103` · CVE record: contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Nov 2024 · Tags: CWE-640
- [IBM Security SOAR weak password recovery mechanism](https://agentprime.io/advisories/CVE-2024-45670.md)
  `CVE-2024-45670` · CVE record: IBM Security SOAR · CVSS 5.6 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-640
- [Press has a potential 2FA bypass](https://agentprime.io/advisories/CVE-2024-50356.md)
  `CVE-2024-50356` · CVE record: frappe press · CVSS 0.0 None · Not analysed yet · Published 31 Oct 2024 · Tags: CWE-640
- [App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP](https://agentprime.io/advisories/CVE-2024-9302.md)
  `CVE-2024-9302` · CVE record: appcheap App Builder – Create Native Android & iOS Apps On The Flight · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2024 · Tags: CWE-640
- [An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.](https://agentprime.io/advisories/CVE-2024-48428.md)
  `CVE-2024-48428` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2024 · Tags: CWE-640
- [AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP](https://agentprime.io/advisories/CVE-2024-9305.md)
  `CVE-2024-9305` · CVE record: scottopolis AppPresser – Mobile App Framework · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-640
- [QileCMS Verification Code Forget.php sendEmail password recovery](https://agentprime.io/advisories/CVE-2024-9907.md)
  `CVE-2024-9907` · CVE record: QileCMS · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2024 · Tags: CWE-640
- [A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.](https://agentprime.io/advisories/CVE-2024-45980.md)
  `CVE-2024-45980` · CVE record · CVSS 8.8 High · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-640
- [Unauthenticated Password Reset](https://agentprime.io/advisories/CVE-2024-8878.md)
  `CVE-2024-8878` · CVE record: Riello Netman 204 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2024 · Tags: CWE-640
- [TDuckCloud TDuckPro password recovery](https://agentprime.io/advisories/CVE-2024-8692.md)
  `CVE-2024-8692` · CVE record: TDuckCloud TDuckPro · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-640

Newest: <https://agentprime.io/advisories/tag/cwe-640.md>
Older: <https://agentprime.io/advisories/tag/cwe-640.md?cursor=WyIyMDI0LTA5LTExVDE4OjMxOjA4LjYzODAwMFoiLCJDVkUtMjAyNC04NjkyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-640&cursor=WyIyMDI2LTAxLTIyVDEzOjAyOjExLjExNTAwMFoiLCJDVkUtMjAyNi0xMzI1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-640/?cursor=WyIyMDI2LTAxLTIyVDEzOjAyOjExLjExNTAwMFoiLCJDVkUtMjAyNi0xMzI1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.