Monthly
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Password validation bypass in OpenProject's REST API allows an attacker who has already seized a valid user session to change that account's password without supplying the current password, exploiting CWE-620 (Unverified Password Change) via a crafted PATCH request to /api/v3/users/me. Affected versions are all OpenProject releases prior to 17.3.2 and 17.4.0 (CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, when chained with a session-takeover primitive, it converts transient access into persistent account control.
Authentication bypass and account takeover in OpenAM Community Edition (OpenIdentity Platform) through 16.0.6 allows unauthenticated attackers to log in as any user who has authenticated via the OAuth2 module. The OAuth2 module silently rewrites a local user's password to the literal value of their own username, after which the default ldapService chain accepts the username as both identifier and password at the standard authenticate endpoint - no IdP interaction needed. No public exploit identified at time of analysis, but the attack requires only knowledge of a target username once the password-rewrite has fired.
Account takeover in Flowise (the open-source low-code LLM application builder) before version 3.0.10 stems from the account settings Security section accepting a password change without requiring the current password or any re-verification. Any authenticated user - or an attacker who hijacks or coerces an existing authenticated session - can silently reset the account credential and seize full control of the account. Publicly available exploit code exists (documented PoC with repro steps and screenshot in the GitHub Security Advisory GHSA-fjh6-8679-9pch), but there is no public exploit identified as actively exploited and it is not listed in CISA KEV.
Account takeover in Flowise versions 3.0.7 and earlier allows an authenticated user to change their account email address via the profile endpoint without re-authenticating or confirming the change to the original email. Because email serves as both login identifier and password-recovery channel, an attacker who has hijacked a session (e.g., via XSS, stolen token, or unattended workstation) can pivot to permanent account ownership. Publicly available exploit code exists in the GitHub Security Advisory with reproduction steps, but no public exploit identified as actively used in the wild.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Password validation bypass in OpenProject's REST API allows an attacker who has already seized a valid user session to change that account's password without supplying the current password, exploiting CWE-620 (Unverified Password Change) via a crafted PATCH request to /api/v3/users/me. Affected versions are all OpenProject releases prior to 17.3.2 and 17.4.0 (CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, when chained with a session-takeover primitive, it converts transient access into persistent account control.
Authentication bypass and account takeover in OpenAM Community Edition (OpenIdentity Platform) through 16.0.6 allows unauthenticated attackers to log in as any user who has authenticated via the OAuth2 module. The OAuth2 module silently rewrites a local user's password to the literal value of their own username, after which the default ldapService chain accepts the username as both identifier and password at the standard authenticate endpoint - no IdP interaction needed. No public exploit identified at time of analysis, but the attack requires only knowledge of a target username once the password-rewrite has fired.
Account takeover in Flowise (the open-source low-code LLM application builder) before version 3.0.10 stems from the account settings Security section accepting a password change without requiring the current password or any re-verification. Any authenticated user - or an attacker who hijacks or coerces an existing authenticated session - can silently reset the account credential and seize full control of the account. Publicly available exploit code exists (documented PoC with repro steps and screenshot in the GitHub Security Advisory GHSA-fjh6-8679-9pch), but there is no public exploit identified as actively exploited and it is not listed in CISA KEV.
Account takeover in Flowise versions 3.0.7 and earlier allows an authenticated user to change their account email address via the profile endpoint without re-authenticating or confirming the change to the original email. Because email serves as both login identifier and password-recovery channel, an attacker who has hijacked a session (e.g., via XSS, stolen token, or unattended workstation) can pivot to permanent account ownership. Publicly available exploit code exists in the GitHub Security Advisory with reproduction steps, but no public exploit identified as actively used in the wild.