Python EUVD-2025-20241

| CVE-2025-43931 CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2025-07-07 cve@mitre.org

Information Disclosure Python

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20241

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.

AnalysisAI

A security vulnerability in flask-boilerplate through a170e7c (CVSS 9.8) that allows account takeover. Critical severity with potential for significant impact on affected systems.

Technical ContextAI

Vulnerability type not specified by vendor. CVSS 9.8 indicates critical severity with likely remote exploitation vector. Affects flask-boilerplate through a170e7c.

RemediationAI

Monitor vendor channels for patch availability.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2017-9462 HIGH Act Now POC

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-39987 CRITICAL Act Now POC

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

CVE-2026-33017 CRITICAL Act Now POC

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2026-55255 HIGH Act Now POC

Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing

Same weakness CWE-640 – Weak Password Recovery Mechanism for Forgotten Password

View all

CVE-2023-7028 CRITICAL POC

CVE-2017-7615 HIGH POC

CVE-2017-8295 MEDIUM POC

CVE-2025-6216 CRITICAL POC

CVE-2025-47646 CRITICAL POC

CVE-2015-7257 HIGH POC

CVE-2022-50910 CRITICAL POC

CVE-2026-12417 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

EUVD-2025-20241 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy