Mobiapparc
Monthly
Unauthenticated remote attackers can take over arbitrary MobiAPParc accounts by abusing the product's forgotten-password flow, which accepts a predictable, sequential numeric user_id without any proof that the requestor owns the target account, allowing the attacker to set a new password and gain full control of the account. The affected builds are MobiAPParc up to and including 2.28 and up to and including 2.42 (CPE cpe:2.3:a:mobiapparc:mobiapparc:*), and exploitation requires only network reachability of the application - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H confirms no privileges or user interaction are needed. No public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is available, so the elevated 8.8 base score should be read alongside the product's limited deployment footprint rather than as evidence of active exploitation.
Unauthenticated remote attackers can take over arbitrary MobiAPParc accounts by abusing the product's forgotten-password flow, which accepts a predictable, sequential numeric user_id without any proof that the requestor owns the target account, allowing the attacker to set a new password and gain full control of the account. The affected builds are MobiAPParc up to and including 2.28 and up to and including 2.42 (CPE cpe:2.3:a:mobiapparc:mobiapparc:*), and exploitation requires only network reachability of the application - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H confirms no privileges or user interaction are needed. No public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is available, so the elevated 8.8 base score should be read alongside the product's limited deployment footprint rather than as evidence of active exploitation.