Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Aug 21, 2026Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.CVE-2026-61398 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability.CVE-2025-54321 · Other software · Ascertia · reported by MITRECritical 9.8
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comascertia.com
Sep 30, 2025PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality.CVE-2025-8119 · Other software · Polska Akademia Dostępności · reported by cvd@cert.plMedium 5.1
PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
- Product
- PAD CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality.CVE-2025-8117 · Other software · Polska Akademia Dostępności · reported by cvd@cert.plHigh 8.7
PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
- Product
- PAD CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism.CVE-2025-50503 · Other software · reported by MITREHigh 8.8
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide a legitimate authentication factor, such as an OTP. This compromises account security and allows for potential unauthorized access to user data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtouch.com.lb
Jan 29, 2025An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login nameCVE-2024-57439 · Other software · Ruoyi · reported by MITREMedium 4.9
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.CVE-2024-48322 · Other software · run.codes · reported by MITREHigh 8.1
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.
- Product
- run.codes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.CVE-2024-48428 · Other software · Olivegroup · reported by MITRECritical 9.8
An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.
- Product
- Olivevle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0.CVE-2024-49376 · Other software · autolab · reported by GitHubHigh 7.1
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.
- Product
- Autolab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024The "reset password" login page accepted an HTML injection via URL parameters.CVE-2024-3938 · Other software · dotCMS · reported by security@dotcms.comMedium 5.4
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lines: * OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
- Product
- dotCMS core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use.CVE-2024-5277 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.CVE-2024-28270 · Other software · enilu · reported by MITREHigh 8.1
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
- Product
- web-flash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.CVE-2022-27978 · Other software · Tooljet · reported by MITREHigh 7.5
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
- Product
- Tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.CVE-2023-0922 · Other software · Samba · reported by Red HatMedium 5.9
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsecurity.gentoo.org
Mar 8, 2023There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords fCVE-2023-22891 · Other software · Smartbear · reported by MITREHigh 8.1
There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts.
- Product
- Zephyr Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartbear.comsmartbear.com
Sep 23, 2022A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fCVE-2022-32211 · Other software · Rocket.chat · reported by support@hackerone.comHigh 8.8
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Aug 1, 2022An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct CVE-2022-34530 · Other software · Backdropcms · reported by MITREMedium 5.3
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
- Product
- Backdrop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form CVE-2022-1597 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 5.4
- What to do
- Update WPQA Builder to 5.4 or newer.
May 25, 2022In Apache Archiva, any registered user can reset password for any users.CVE-2022-29405 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
- Product
- Apache Archiva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchiva.apache.orgarchiva.apache.org
Apr 7, 2022Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password sCVE-2022-24681 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comraxis.com
Apr 14, 2021Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of CVE-2021-26832 · Other software · Priority-software · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site.
- Product
- Priority Enterprise Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision.CVE-2020-15181 · Other software · FlexSolution · reported by GitHubCritical 9.3
The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0
- Product
- AlfrescoResetPassword
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2020The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account paCVE-2020-25728 · Other software · Alfresco · reported by MITREHigh 8.8
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.
- Product
- Reset Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamriunix.comamriunix.com
Sep 17, 2020The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input fielCVE-2020-25727 · Other software · Flexsolution · reported by MITREHigh 7.5
The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field.
- Product
- Reset Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamriunix.comamriunix.com
Sep 21, 2019The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might CVE-2019-16669 · Other software · Pagekit · reported by MITREMedium 5.3
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
- Product
- Pagekit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2019Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form).CVE-2019-12279 · Other software · Nagios · reported by MITRECritical 9.8
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jul 11, 2018Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the coCVE-2018-10633 · Other software · Universal Robots · reported by ics-cert@hq.dhs.govCritical 9.8
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.
- Product
- Universal Robots Robot Controller version CB 3.1, SW Version 3.4.5-100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 13, 2018PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" errorCVE-2018-5682 · Websites & servers · Prestashop · reported by MITREMedium 5.3
PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.prestashop.comforge.prestashop.com
Jun 29, 2017Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premCVE-2017-8613 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comHigh 8.1
Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."
- Product
- Azure AD Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtechnet.microsoft.com
May 25, 2017The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA releaCVE-2016-3084 · Other software · Pivotal · reported by security_alert@emc.comHigh 8.1
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
- Product
- Cloud Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2014wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveragiCVE-2014-9039 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
- Fixed in
- 3.7.5
- What to do
- Update the plugin to 3.7.5 or newer.
Full record and what to do →NVD recordadvisories.mageia.orgcore.trac.wordpress.org
Jan 22, 2014fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request andCVE-2013-7305 · Other software · E107 · reported by MITREMedium 4.3
fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.
- Product
- E107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Aug 20, 2013The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leverCVE-2013-4962 · Other software · Puppet · reported by MITREMedium 5.8
The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpuppetlabs.compuppetlabs.com
May 12, 2010The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts wCVE-2010-1910 · Other software · Consona · reported by MITREMedium 5.1
The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields.
- Product
- Consona Dynamic Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comwintercore.com
Aug 25, 2009OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 CVE-2008-7066 · Other software · 2enetworx · reported by MITREHigh 7.5
OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 and modified user and password parameters.
- Product
- Openforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Aug 12, 2009member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possiblCVE-2008-6957 · Other software · Discuz · reported by MITREHigh 7.5
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.
- Product
- Discuz!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2005The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to tCVE-2005-3112 · Other software · Macromedia · reported by MITRELow 2.1
The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to the database to obtain the passwords.
- Product
- Breeze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Aug 7, 2003password.asp in Snitz Forums 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by via a direct request to passworCVE-2003-0494 · Other software · Snitz Communications · reported by MITREHigh 10
password.asp in Snitz Forums 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by via a direct request to password.asp with a modified member id.
- Product
- Snitz Forums 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Apr 2, 2003Ecartis 1.0.0 (formerly listar) before snapshot 20030227 allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form CVE-2003-0162 · Other software · Ecartis · reported by MITREHigh 7.5
Ecartis 1.0.0 (formerly listar) before snapshot 20030227 allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page.
- Product
- Ecartis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.