Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Dec 19, 2025LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation.CVE-2023-53958 · Other software · ltb-project · reported by VulnCheckHigh 8.6
LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
- Product
- LDAP Tool Box Self Service Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 29, 2025Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fromCVE-2025-5808 · Other software · OpenText · reported by security@opentext.comHigh 7.3
Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset from before 4.8 patch 3.
- Product
- Self Service Password Reset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS).CVE-2020-11850 · Other software · OpenText · reported by security@opentext.comHigh 7.3
Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.6
- Product
- Self Service Password Reset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS vCVE-2023-49032 · Other software · Ltb-project · reported by MITRECritical 9.8
An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS verification code function to arbitrary phone.
- Product
- Self Service Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2020Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product.CVE-2020-25837 · Other software · Microfocus · reported by security@opentext.comHigh 7.5
Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information.
- Product
- Self Service Password Reset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2019Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4.CVE-2019-11674 · Other software · Microfocus · reported by security@opentext.comMedium 5.9
Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.
- Product
- Netiq Self Service Password Reset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6.CVE-2019-11652 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate.
- Product
- Self Service Password Reset (SSPR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2019An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4.CVE-2019-11648 · Other software · Micro Focus · reported by security@opentext.comHigh 7.5
An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited to expose sensitive information.
- Product
- Micro Focus NetIQ Self Service Password Reset.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2019A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4.CVE-2019-11647 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
- Product
- Micro Focus NetIQ Self Service Password Reset.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, becauCVE-2018-12421 · Other software · Ltb-project · reported by MITRECritical 9.8
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
- Product
- Ldap Tool BOX Self Service Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2016Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary weCVE-2016-1599 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
- Product
- Self Service Password Reset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.netiq.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.