Monthly
Weak password recovery in Beetel 450TC3 router firmware 01.00.00_01 allows low-privileged authenticated attackers to exploit a flawed account recovery workflow over the network, potentially escalating privileges to administrative control of the device. A public proof-of-concept has been disclosed on GitHub, and the exploit reference explicitly describes authenticated privilege escalation as the realized impact. The vendor did not respond to coordinated disclosure, meaning no patch exists and no vendor-confirmed mitigations are available.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC signature is bound only to the user's database ID, not the password hash. An attacker who obtains an intercepted or cached reset link can authenticate as the victim up to 2 additional times within a 1-hour window even after the victim has changed their password, obtaining a fully authenticated session. A publicly documented proof-of-concept is included in the GHSA advisory; no active exploitation via CISA KEV has been confirmed.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
Tenant admin account takeover in Budibase self-hosted deployments before 3.40.0 is achievable by any authenticated user, including the lowest-privilege BASIC app user. The PUT /api/global/users/tenant/owner endpoint fails to enforce the cloudRestricted middleware on self-hosted instances where SELF_HOSTED or DISABLE_ACCOUNT_PORTAL is set, allowing any valid session to silently reassign the tenant owner email address to an attacker-controlled value. By then triggering the public password-reset flow against that address, the attacker achieves full administrative control over the entire Budibase tenant; no public exploit has been identified at time of analysis, but the single authenticated API call required makes the exploit chain mechanistically trivial for any user who holds even a basic account.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
Weak password recovery in Beetel 450TC3 router firmware 01.00.00_01 allows low-privileged authenticated attackers to exploit a flawed account recovery workflow over the network, potentially escalating privileges to administrative control of the device. A public proof-of-concept has been disclosed on GitHub, and the exploit reference explicitly describes authenticated privilege escalation as the realized impact. The vendor did not respond to coordinated disclosure, meaning no patch exists and no vendor-confirmed mitigations are available.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC signature is bound only to the user's database ID, not the password hash. An attacker who obtains an intercepted or cached reset link can authenticate as the victim up to 2 additional times within a 1-hour window even after the victim has changed their password, obtaining a fully authenticated session. A publicly documented proof-of-concept is included in the GHSA advisory; no active exploitation via CISA KEV has been confirmed.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
Tenant admin account takeover in Budibase self-hosted deployments before 3.40.0 is achievable by any authenticated user, including the lowest-privilege BASIC app user. The PUT /api/global/users/tenant/owner endpoint fails to enforce the cloudRestricted middleware on self-hosted instances where SELF_HOSTED or DISABLE_ACCOUNT_PORTAL is set, allowing any valid session to silently reassign the tenant owner email address to an attacker-controlled value. By then triggering the public password-reset flow against that address, the attacker achieves full administrative control over the entire Budibase tenant; no public exploit has been identified at time of analysis, but the single authenticated API call required makes the exploit chain mechanistically trivial for any user who holds even a basic account.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.