Monthly
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OpenAM Community Edition 16.0.6 and earlier silently overwrites a user's local password with the literal string of their username whenever an existing account is re-authenticated through the OAuth2 authentication module, and the default ldapService chain then accepts that username-as-password combination. Because the flaw yields a predictable credential, an unauthenticated attacker who knows a valid username can obtain a fully privileged session for that principal simply by submitting the standard authenticate request with username and password both set to the username, with no IdP interaction required. The vendor patched the issue in OpenAM Community Edition 16.1.1 (commit 7993f6d); no public exploit code or CISA KEV entry was present in the intelligence provided at time of analysis.
Unauthenticated administrator password reset in KMW KM-IP521 and KM-IP421 CCTV cameras allows remote network-based attackers to reset the admin credential to a known value and obtain full control of the device, including live video feeds and configuration. The flaw is classified under CWE-620 (Unverified Password Change) and was disclosed via CISA's ICS-CERT coordination channel with a CVSS 9.1 rating. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it high-priority for any internet- or LAN-exposed deployments.
OpenC3 COSMOS password change functionality accepts valid session tokens in lieu of current passwords, enabling attackers with hijacked tokens to lock out legitimate users and maintain persistent access to compromised accounts including administrator accounts. Publicly available exploit code demonstrates the attack chain. All versions prior to 6.10.5 and 7.0.0-rc1 through 7.0.0-rc2 are affected. The vendor has released patched versions 6.10.5 and 7.0.0-rc3 that enforce password-only verification during password change operations.
Account takeover in blueprintUE Self-Hosted Edition <4.2.0 allows authenticated attackers to permanently hijack any account by changing its password without current password verification. Attackers who obtain session access through XSS, session hijacking, physical access, or stolen cookies can immediately lock out legitimate users. The vulnerability requires low-privileged authentication (PR:L) but has high confidentiality and integrity impact, enabling full account control and data access. Fixed in version 4.2.0.
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OpenAM Community Edition 16.0.6 and earlier silently overwrites a user's local password with the literal string of their username whenever an existing account is re-authenticated through the OAuth2 authentication module, and the default ldapService chain then accepts that username-as-password combination. Because the flaw yields a predictable credential, an unauthenticated attacker who knows a valid username can obtain a fully privileged session for that principal simply by submitting the standard authenticate request with username and password both set to the username, with no IdP interaction required. The vendor patched the issue in OpenAM Community Edition 16.1.1 (commit 7993f6d); no public exploit code or CISA KEV entry was present in the intelligence provided at time of analysis.
Unauthenticated administrator password reset in KMW KM-IP521 and KM-IP421 CCTV cameras allows remote network-based attackers to reset the admin credential to a known value and obtain full control of the device, including live video feeds and configuration. The flaw is classified under CWE-620 (Unverified Password Change) and was disclosed via CISA's ICS-CERT coordination channel with a CVSS 9.1 rating. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it high-priority for any internet- or LAN-exposed deployments.
OpenC3 COSMOS password change functionality accepts valid session tokens in lieu of current passwords, enabling attackers with hijacked tokens to lock out legitimate users and maintain persistent access to compromised accounts including administrator accounts. Publicly available exploit code demonstrates the attack chain. All versions prior to 6.10.5 and 7.0.0-rc1 through 7.0.0-rc2 are affected. The vendor has released patched versions 6.10.5 and 7.0.0-rc3 that enforce password-only verification during password change operations.
Account takeover in blueprintUE Self-Hosted Edition <4.2.0 allows authenticated attackers to permanently hijack any account by changing its password without current password verification. Attackers who obtain session access through XSS, session hijacking, physical access, or stolen cookies can immediately lock out legitimate users. The vulnerability requires low-privileged authentication (PR:L) but has high confidentiality and integrity impact, enabling full account control and data access. Fixed in version 4.2.0.