An issue was discovered in UsualToolCMS 8.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.