Advisories · Weakness
CWE-640.
Every Advisory and CVE whose sources give the weakness CWE-640, newest first.
- CVSS 8.5 High
Beehive Forum - Account Takeover
- Beehive Forum
- CWE-640
- CVSS 10.0 CriticalCritical · CVSS 9+
A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a re…
- CWE-640
- CVSS 6.3 Medium
Uasoft badaso Token BadasoAuthController.php forgetPassword password recovery
- Uasoft badaso
- CWE-640
- CVSS 4.3 Medium
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CWE-640
- CVSS 8.6 High
LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header
- ltb-project LDAP Tool Box Self Service Password
- CWE-640
- CVSS 7.1 High
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlle…
- Cross-site request forgery (CSRF)
- CWE-353
- CVSS 6.9 Medium
Shenzhen Sixun Software Sixun Shanghui Group Business Management System UpdatePasswordBatch password recovery
- Shenzhen Sixun Software Sixun Shanghui Group Business Management System
- CWE-640
- CVSS 9.3 Critical
Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition
- CWE-640
<4.9.1.81 · fixed in 4.9.1.81
GHSA-95fv-5gfj-2r84 · CVE-2025-64113 - CVSS 8.7 High
MAXHUB Pivot Weak Password Recovery Mechanism for Forgotten Password
- MAXHUB Pivot client application
- CWE-640
- CVSS 8.8 High
Host header poisoning allows account takeover via password reset email
- MasaCMS
- CWE-346
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.
- CWE-640
- CVSS 6.9 Medium
SourceCodester Inventory Management System resetPassword.php password recovery
- SourceCodester Inventory Management System
- CWE-640
- CVSS 6.8 Medium
ClipBucket v5 is vulnerable to password reset link manipulation
- MacWarrior clipbucket-v5
- CWE-640
- CVSS 8.1 High
Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
- Piwigo
- CWE-640
- CVSS 5.0 Medium
Shopware 6's password recovery link does not expire after email change
- CWE-640
<6.6.10.9 || >=6.7.0.0, <6.7.4.1 · fixed in 6.6.10.9, 6.7.4.1
GHSA-2w46-vq8h-98vh - CVSS 8.1 High
2FA Expiry Bypass in Optimus Software's Brokerage Automation
- Optimus Software Brokerage Automation
- Broken access control
- CWE-302
- CVSS 9.3 CriticalCritical · CVSS 9+
Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism
- Hundred Plus EIP Plus
- CWE-640
- CVSS 8.1 High
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
- Open redirect
- CWE-640
<1.80.0-v2.20.0.20251029090537-72a5c33e6ac3 || >=2.0.0, <2.71.18 · fixed in 1.80.0-v2.20.0.20251029090537-72a5c33e6ac3, 2.71.18
GHSA-mwmh-7px9-4c23 · CVE-2025-64101 - CVSS 7.3 High
AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password
- AutomationDirect Productivity Suite
- AutomationDirect Productivity 3000 P3-622 CPU
- CWE-640
- CVSS 6.4 Medium
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tok…
- CWE-640
- CVSS 8.1 High
Weak password recovery vulnerability
- vmware NSX
- CWE-640
- CVSS 6.9 Medium
Wavlink WL-WN578W2 sysinit.html password recovery
- Wavlink WL-WN578W2
- CWE-640
- CVSS 8.8 High
Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password
- Daikin Europe N.V Security Gateway
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability
- Hossein Material Dashboard
- CWE-640
- CVSS 8.8 High
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism.
- CWE-640
- CVSS 6.1 Medium
Content-Disposition headers incorrectly ignored for some MIME types
- Mozilla Firefox for iOS
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account pass…
- CWE-640
- CVSS 5.3 Medium
jshERP updatePwd password recovery
- jshERP
- CWE-640
- CVSS 5.1 Medium
Mercusys MW301R Web Interface password recovery
- Mercusys MW301R
- CWE-640
- CVSS 5.9 Medium
IBM Engineering Requirements Management DOORS weak authentication
- IBM Engineering Requirements Management DOORS
- CWE-640
- CVSS 8.9 High
Natours has a 1 Click Account take over on reset password via Host Header injection
- ahmed-elgaml11 Natours
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
- CWE-640
- CVSS 8.1 High
Kanboard Password Reset Poisoning via Host Header Injection
- kanboard
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability
- Allegra
- CWE-640
- CVSS 6.9 Medium
UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change
- UTT 进取 750W
- CWE-620
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability
- Gilblas Ngunte Possi PSW Front-end Login & Registration
- CWE-640
- CVSS 6.9 Medium
D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change
- D-Link DI-7003GV2
- CWE-620
- CWE-640
- CVSS 5.3 Medium
ContiNew Admin password unverified password change
- ContiNew Admin
- CWE-620
- CWE-640
- CVSS 5.3 Medium
YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change
- YXJ2018 SpringBoot-Vue-OnlineExam
- CWE-620
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability
- videowhisper Paid Videochat Turnkey Site
- CWE-640
- CVSS 8.8 High
BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
- PX-lab BoomBox Theme Extensions
- CWE-640
- CVSS 8.3 High
Account Takeover Vulnerability in CAP back office application
- Rising Technosoft CAP back office application
- CWE-640
- CVSS 6.5 Medium
Improper Authentication in Tapandsign Technologies Tap and Sign App
- Tapandsign Technologies Tap&Sign App
- CWE-526
- CWE-640
- CVSS 2.3 Low
PHPGurukul Online Library Management System change-password.php password recovery
- PHPGurukul Online Library Management System
- CWE-640
- CVSS 8.1 High
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
- wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads
- CWE-640
- CVSS 6.9 Medium
YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery
- YunzMall
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
- scriptsbundle AdForest
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
- CWE-640
- CVSS 9.3 CriticalCritical · CVSS 9+
Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password
- Ruijie Reyee OS
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- CWE-640
- CVSS 5.6 Medium
IBM Security SOAR weak password recovery mechanism
- IBM Security SOAR
- CWE-640
- CVSS 0.0 None
Press has a potential 2FA bypass
- frappe press
- CWE-640
- CVSS 8.1 High
App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP
- appcheap App Builder – Create Native Android & iOS Apps On The Flight
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.
- CWE-640
- CVSS 8.1 High
AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP
- scottopolis AppPresser – Mobile App Framework
- CWE-640
- CVSS 6.3 Medium
QileCMS Verification Code Forget.php sendEmail password recovery
- QileCMS
- CWE-640
- CVSS 8.8 High
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.
- CWE-640
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Password Reset
- Riello Netman 204
- CWE-640
- CVSS 6.9 Medium
TDuckCloud TDuckPro password recovery
- TDuckCloud TDuckPro
- CWE-640