Monthly
OmniRoute 3.8.0 through 3.8.51 lets a caller who already holds a manage- or admin-scoped API key, or an oma_ access token, replace the instance management password or toggle the login requirement via POST /api/settings/require-login without supplying the current password, and the same machine credentials could also weaken security-policy keys such as requireLogin, newPassword, oidc*, corsOrigins and bruteForceProtection on PATCH /api/settings. The practical outcomes are dashboard login takeover, operator lockout, or disabling the login requirement altogether, but the flaw sits behind an already-elevated machine credential (CVSS 4.0 PR:H, assessed as CVSS 3.1 PR:H), so it is an authorization-enforcement failure rather than anonymous remote takeover. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor addressed it in release 3.8.52 with an operator-only enforcement path, and the vuln.today decision label places remediation in this week's window.
Account takeover in ProjectSend 2.5.0 through 2.6.x lets anyone holding a stolen session cookie for a Social-provisioned account set a durable local password through PUT /settings/password without supplying the current password, flipping the account to local authentication and allowing the attacker to enroll their own second factor. Only accounts whose auth_source is Social (external/provider sign-in) are reachable and the attacker must already hold a live session, but the resulting persistence outlives session expiry and survives routine session hygiene. No public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor shipped a fix in 2.7.0 that rejects the form path for provider accounts and substitutes an emailed reset link to the account's own address.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
Unauthenticated credential takeover in pig-mesh Pig before 4.1.0 allows any remote attacker who can reach the /register/password endpoint to overwrite the password of an arbitrary account, including the built-in 'admin' account, and thereby obtain full administrative control of the platform. The flaw is an authentication bypass: the endpoint's password-reset logic calls checkPassword() but discards the boolean result, so the submitted 'current password' is never actually validated. Publicly available exploit code exists (a proof-of-concept write-up and the upstream issue are linked), and the vendor has released version 4.1.0 as the fix; there is no indication of confirmed exploitation in CISA KEV at the time of analysis, but the combination of unauthenticated remote exploitation, high impact (CVSS 4.0 base 9.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and public exploit code makes rapid patching warranted.
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.
OmniRoute 3.8.0 through 3.8.51 lets a caller who already holds a manage- or admin-scoped API key, or an oma_ access token, replace the instance management password or toggle the login requirement via POST /api/settings/require-login without supplying the current password, and the same machine credentials could also weaken security-policy keys such as requireLogin, newPassword, oidc*, corsOrigins and bruteForceProtection on PATCH /api/settings. The practical outcomes are dashboard login takeover, operator lockout, or disabling the login requirement altogether, but the flaw sits behind an already-elevated machine credential (CVSS 4.0 PR:H, assessed as CVSS 3.1 PR:H), so it is an authorization-enforcement failure rather than anonymous remote takeover. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor addressed it in release 3.8.52 with an operator-only enforcement path, and the vuln.today decision label places remediation in this week's window.
Account takeover in ProjectSend 2.5.0 through 2.6.x lets anyone holding a stolen session cookie for a Social-provisioned account set a durable local password through PUT /settings/password without supplying the current password, flipping the account to local authentication and allowing the attacker to enroll their own second factor. Only accounts whose auth_source is Social (external/provider sign-in) are reachable and the attacker must already hold a live session, but the resulting persistence outlives session expiry and survives routine session hygiene. No public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor shipped a fix in 2.7.0 that rejects the form path for provider accounts and substitutes an emailed reset link to the account's own address.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
Unauthenticated credential takeover in pig-mesh Pig before 4.1.0 allows any remote attacker who can reach the /register/password endpoint to overwrite the password of an arbitrary account, including the built-in 'admin' account, and thereby obtain full administrative control of the platform. The flaw is an authentication bypass: the endpoint's password-reset logic calls checkPassword() but discards the boolean result, so the submitted 'current password' is never actually validated. Publicly available exploit code exists (a proof-of-concept write-up and the upstream issue are linked), and the vendor has released version 4.1.0 as the fix; there is no indication of confirmed exploitation in CISA KEV at the time of analysis, but the combination of unauthenticated remote exploitation, high impact (CVSS 4.0 base 9.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and public exploit code makes rapid patching warranted.
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (CWE-620), letting an attacker who holds any temporary or low-privilege session set a new password without proving they know the old one. Because the CVSS 4.0 vector reflects a low-privilege (PR:L) network attacker with high confidentiality and integrity impact, a hijacked or briefly-borrowed session can be converted into permanent control, locking legitimate users out. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so risk is credible but not confirmed as actively exploited.