Emsigner
Monthly
Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in EMSigner v2.8.7's AdHoc User creation form permits unauthenticated remote attackers to arbitrarily modify usernames and elevate privileges by supplying the email address of any registered user, requiring no credentials or user interaction. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects a trivial exploitation path against any internet-exposed instance. Publicly available exploit code exists at secpro.llc, though the EPSS score of 0.46% (37th percentile) indicates limited observed widespread exploitation at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in EMSigner v2.8.7's AdHoc User creation form permits unauthenticated remote attackers to arbitrarily modify usernames and elevate privileges by supplying the email address of any registered user, requiring no credentials or user interaction. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects a trivial exploitation path against any internet-exposed instance. Publicly available exploit code exists at secpro.llc, though the EPSS score of 0.46% (37th percentile) indicates limited observed widespread exploitation at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.