Common Weakness Enumeration
CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
485 vulnerabilities reference this CWE, most recent first.
CVE-2026-116214 (GCVE-0-2026-116214)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08
VLAI
EPSS
VEX
Title
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
Summary
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Severity
9.1 (Critical)
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/magicblack/maccms10/commit/27b… | patch |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-b… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , < 2026.1000.4054
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThan": "2026.1000.4054",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.141Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
},
{
"name": "Fix Commit (magicblack/maccms10)",
"tags": [
"patch"
],
"url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
}
],
"title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116214",
"datePublished": "2026-10-26T13:08:47.141Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-26T13:08:47.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115973 (GCVE-0-2026-115973)
Vulnerability from cvelistv5 – Published: 2026-10-24 18:15 – Updated: 2026-10-24 18:15
VLAI
EPSS
VEX
Title
FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
Summary
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Severity
CWE
- CWE-640 - Weak Password Recovery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426054 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426054/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115973 | third-party-advisory |
| https://vuldb.com/submit/986184 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FaveoSuite | Faveo Helpdesk |
Affected:
2.0.3
cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:*"
],
"product": "Faveo Helpdesk",
"vendor": "FaveoSuite",
"versions": [
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ibrohimm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T18:15:15.067Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426054 | FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426054"
},
{
"name": "VDB-426054 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426054/cti"
},
{
"name": "CVE-2026-115973 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115973"
},
{
"name": "Submit #986184 | Faveo Faveo Helpdesk 2.0.3 Weak Password Recovery Mechanism",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/986184"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T02:58:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115973",
"datePublished": "2026-10-24T18:15:15.067Z",
"dateReserved": "2026-10-24T00:52:48.359Z",
"dateUpdated": "2026-10-24T18:15:15.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112035 (GCVE-0-2026-112035)
Vulnerability from cvelistv5 – Published: 2026-10-19 00:30 – Updated: 2026-10-19 16:31
VLAI
EPSS
VEX
Title
aircheng-org iWebShop-5 simple.php send_message_mobile password recovery
Summary
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:30 UTC
CWE
- CWE-640 - Weak Password Recovery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421683 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421683/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112035 | third-party-advisory |
| https://vuldb.com/submit/1008390 | third-party-advisory |
| https://github.com/aircheng-org/iWebShop-5/issues/11 | exploitissue-tracking |
| https://github.com/aircheng-org/iWebShop-5/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aircheng-org | iWebShop-5 |
Affected:
5.0
Affected: 5.1 Affected: 5.2 Affected: 5.3 Affected: 5.4 Affected: 5.5 Affected: 5.6 Affected: 5.7 Affected: 5.8 Affected: 5.9 Affected: 5.10 Affected: 5.11 Affected: 5.12 Affected: 5.13 Affected: 5.14 Affected: 5.15 Affected: 5.16 cpe:2.3:a:aircheng-org:iwebshop-5:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112035",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:30:43.513817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:31:06.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/aircheng-org/iWebShop-5/issues/11"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:aircheng-org:iwebshop-5:*:*:*:*:*:*:*:*"
],
"product": "iWebShop-5",
"vendor": "aircheng-org",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
},
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.3"
},
{
"status": "affected",
"version": "5.4"
},
{
"status": "affected",
"version": "5.5"
},
{
"status": "affected",
"version": "5.6"
},
{
"status": "affected",
"version": "5.7"
},
{
"status": "affected",
"version": "5.8"
},
{
"status": "affected",
"version": "5.9"
},
{
"status": "affected",
"version": "5.10"
},
{
"status": "affected",
"version": "5.11"
},
{
"status": "affected",
"version": "5.12"
},
{
"status": "affected",
"version": "5.13"
},
{
"status": "affected",
"version": "5.14"
},
{
"status": "affected",
"version": "5.15"
},
{
"status": "affected",
"version": "5.16"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T00:30:56.113Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421683 | aircheng-org iWebShop-5 simple.php send_message_mobile password recovery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421683"
},
{
"name": "VDB-421683 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421683/cti"
},
{
"name": "CVE-2026-112035 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112035"
},
{
"name": "Submit #1008390 | aircheng-org iWebShop-5 eb7f7eb1c6ebf39a54f943d8e0aefe96a3b8ff54 Weak Password Recovery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008390"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/aircheng-org/iWebShop-5/issues/11"
},
{
"tags": [
"product"
],
"url": "https://github.com/aircheng-org/iWebShop-5/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T10:54:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "aircheng-org iWebShop-5 simple.php send_message_mobile password recovery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112035",
"datePublished": "2026-10-19T00:30:56.113Z",
"dateReserved": "2026-10-18T08:49:08.389Z",
"dateUpdated": "2026-10-19T16:31:06.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109204 (GCVE-0-2026-109204)
Vulnerability from cvelistv5 – Published: 2026-10-12 13:39 – Updated: 2026-10-18 12:03
VLAI
EPSS
VEX
Title
LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket
Summary
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:45 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/logicaldoc/community/discussions/119 | technical-description |
| https://github.com/logicaldoc/community/commit/af… | patch |
| https://github.com/logicaldoc/community/blob/9.3/… | technical-description |
| https://github.com/logicaldoc/community | product |
| https://www.vulncheck.com/advisories/logicaldoc-c… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LogicalDOC | LogicalDOC Community Edition |
Affected:
0 , ≤ 9.3
(custom)
cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:* |
Date Public
2026-10-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:45:41.489364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:03:15.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LogicalDOC Community Edition",
"repo": "https://github.com/logicaldoc/community",
"vendor": "LogicalDOC",
"versions": [
{
"lessThanOrEqual": "9.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:*",
"versionEndIncluding": "9.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ikram-4"
}
],
"datePublic": "2026-10-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims\u0027 passwords, lock them out, and reveal their email addresses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T13:39:45.921Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/logicaldoc/community/discussions/119"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101"
},
{
"tags": [
"product"
],
"url": "https://github.com/logicaldoc/community"
},
{
"name": "VulnCheck Advisory: LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-forced-password-reset-via-unbound-pswrecovery-ticket"
}
],
"title": "LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109204",
"datePublished": "2026-10-12T13:39:45.921Z",
"dateReserved": "2026-10-12T13:25:17.569Z",
"dateUpdated": "2026-10-18T12:03:15.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108737 (GCVE-0-2026-108737)
Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:47
VLAI
EPSS
VEX
Title
Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
Summary
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:46 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/traccar-token-purpose-co… | third-party-advisory |
| https://github.com/traccar/traccar/blob/cfab560c7… | technical-description |
| https://github.com/traccar/traccar/blob/cfab560c7… | technical-description |
| https://github.com/traccar/traccar/blob/cfab560c7… | technical-description |
| https://github.com/traccar/traccar | product |
| https://www.vulncheck.com/advisories/traccar-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108737",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:46:58.105470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:47:31.147Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind/traccar-token-purpose-confusion"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/traccar/traccar",
"product": "Traccar",
"repo": "https://github.com/traccar/traccar",
"vendor": "Traccar",
"versions": [
{
"lessThanOrEqual": "6.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:19:42.967Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/traccar-token-purpose-confusion"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/signature/TokenManager.java#L47-L109"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/PasswordResource.java#L72-L90"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.java#L77-L93"
},
{
"tags": [
"product"
],
"url": "https://github.com/traccar/traccar"
},
{
"name": "VulnCheck Advisory: Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/traccar-through-6.16.0-weak-password-recovery-via-tokenmanager-token-purpose-confusion"
}
],
"title": "Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108737",
"datePublished": "2026-10-11T12:19:42.967Z",
"dateReserved": "2026-10-11T01:52:49.949Z",
"dateUpdated": "2026-10-13T19:47:31.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108337 (GCVE-0-2026-108337)
Vulnerability from cvelistv5 – Published: 2026-10-14 21:43 – Updated: 2026-10-16 20:18
VLAI
EPSS
VEX
Title
Password Reset Code Accessible in User Listing API
Summary
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:18 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hitachi Vantara | Remot Ops Agent |
Unaffected:
2.1
Affected: 1.6.0 , ≤ 2.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:18:20.301830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:18:39.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Web Interface"
],
"product": "Remot Ops Agent",
"vendor": "Hitachi Vantara",
"versions": [
{
"status": "unaffected",
"version": "2.1"
},
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Internal"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn administrator could retrieve the password reset code for any user and take over the account.\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe password reset codes were included in the output of an API and could be used to reset the password\u0026nbsp;\u003c/span\u003e\u003cspan\u003eof any account. The API is limited to use by administrator accounts only.\u003c/span\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eAn attacker who already has administrative access to the application could compromise the credentials\u0026nbsp;of other accounts on the application. Device credentials and customer data cannot be accessed with this\u0026nbsp;vulnerability.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An administrator could retrieve the password reset code for any user and take over the account.\n\n\n\nThe password reset codes were included in the output of an API and could be used to reset the password\u00a0of any account. The API is limited to use by administrator accounts only.\n\n\n\nAn attacker who already has administrative access to the application could compromise the credentials\u00a0of other accounts on the application. Device credentials and customer data cannot be accessed with this\u00a0vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-50 Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T21:43:08.247Z",
"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"shortName": "HITVAN"
},
"references": [
{
"url": "https://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=261012131624707\u0026guest=0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the password reset feature in the web interface.\u0026nbsp;\u003cspan\u003eThis vulnerability is addressed in Remote Ops Agent version 2.1.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Disable the password reset feature in the web interface.\u00a0This vulnerability is addressed in Remote Ops Agent version 2.1."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Password Reset Code Accessible in User Listing API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"assignerShortName": "HITVAN",
"cveId": "CVE-2026-108337",
"datePublished": "2026-10-14T21:43:08.247Z",
"dateReserved": "2026-10-09T19:44:31.685Z",
"dateUpdated": "2026-10-16T20:18:39.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108335 (GCVE-0-2026-108335)
Vulnerability from cvelistv5 – Published: 2026-10-14 21:39 – Updated: 2026-10-15 15:25
VLAI
EPSS
VEX
Title
Password Reset Functionality Missing Brute-Force Protection
Summary
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:25 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hitachi Vantara | Remote Ops Agent |
Unaffected:
2.1
Affected: 1.6.0 , ≤ 2.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:25:23.730305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:25:31.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Web Interface"
],
"product": "Remote Ops Agent",
"vendor": "Hitachi Vantara",
"versions": [
{
"status": "unaffected",
"version": "2.1"
},
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Internal"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the password reset functionality is enabled, and email is configured, an attacker could take over\u0026nbsp;any account using a brute-force attack.\u003c/p\u003e\u003cp\u003eThere is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force\u0026nbsp;solution to the password reset challenge.\u003c/p\u003e\u003cp\u003eAn attacker could gain administrative access to the application and perform actions like configuring the\u0026nbsp;service or requesting log collection. Device credentials and customer data cannot be accessed with this\u0026nbsp;vulnerability.\u003c/p\u003e"
}
],
"value": "When the password reset functionality is enabled, and email is configured, an attacker could take over\u00a0any account using a brute-force attack.\n\n\n\nThere is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force\u00a0solution to the password reset challenge.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the\u00a0service or requesting log collection. Device credentials and customer data cannot be accessed with this\u00a0vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-50 Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T21:39:17.470Z",
"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"shortName": "HITVAN"
},
"references": [
{
"url": "https://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=261012131624707\u0026guest=0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability is addressed in Remote Ops Agent version 2.1. Migration is recommended."
}
],
"value": "This vulnerability is addressed in Remote Ops Agent version 2.1. Migration is recommended."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Password Reset Functionality Missing Brute-Force Protection",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"assignerShortName": "HITVAN",
"cveId": "CVE-2026-108335",
"datePublished": "2026-10-14T21:39:17.470Z",
"dateReserved": "2026-10-09T19:44:28.337Z",
"dateUpdated": "2026-10-15T15:25:31.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107640 (GCVE-0-2026-107640)
Vulnerability from cvelistv5 – Published: 2026-10-08 14:10 – Updated: 2026-10-08 16:04
VLAI
EPSS
VEX
Title
Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
Summary
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 16:04 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.enablesecurity.com/advisories/ES2026-… | third-party-advisoryexploit |
| https://www.integrics.com/enswitch/ | product |
| https://www.vulncheck.com/advisories/integrics-en… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107640",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T16:04:05.635338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:04:49.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enswitch",
"vendor": "Integrics",
"versions": [
{
"lessThanOrEqual": "4.4",
"status": "affected",
"version": "3.13",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enable Security"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:10:36.452Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://www.enablesecurity.com/advisories/ES2026-06-enswitch-password-reset-bypass/"
},
{
"tags": [
"product"
],
"url": "https://www.integrics.com/enswitch/"
},
{
"name": "VulnCheck Advisory: Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/integrics-enswitch-3.13-through-4.4-authentication-bypass-via-password-reset-api"
}
],
"title": "Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107640",
"datePublished": "2026-10-08T14:10:36.452Z",
"dateReserved": "2026-10-08T14:06:01.084Z",
"dateUpdated": "2026-10-08T16:04:49.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105785 (GCVE-0-2026-105785)
Vulnerability from cvelistv5 – Published: 2026-10-05 23:12 – Updated: 2026-10-08 02:35
VLAI
EPSS
VEX
Title
Joplin Server password reset accepts tokens issued for unrelated purposes
Summary
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:35 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/laurent22/joplin/security/advi… | x_refsource_CONFIRM |
| https://github.com/laurent22/joplin/pull/16274 | x_refsource_MISC |
| https://github.com/laurent22/joplin/commit/7766ee… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105785",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:35:04.011804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:35:28.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim\u0027s CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim\u0027s password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T23:12:45.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35"
},
{
"name": "https://github.com/laurent22/joplin/pull/16274",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laurent22/joplin/pull/16274"
},
{
"name": "https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118"
}
],
"source": {
"advisory": "GHSA-8qm8-mp6h-qf35",
"discovery": "UNKNOWN"
},
"title": "Joplin Server password reset accepts tokens issued for unrelated purposes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105785",
"datePublished": "2026-10-05T23:12:45.286Z",
"dateReserved": "2026-10-05T20:37:19.363Z",
"dateUpdated": "2026-10-08T02:35:28.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102115 (GCVE-0-2026-102115)
Vulnerability from cvelistv5 – Published: 2026-09-30 20:19 – Updated: 2026-10-01 13:37
VLAI
EPSS
VEX
Title
Kiteworks Core Authentication Bypass in the Password Reset Workflow
Summary
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 13:27 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kiteworks/security-advisories/… | vendor-advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T13:27:29.042797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T13:37:03.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Core",
"vendor": "Kiteworks",
"versions": [
{
"lessThan": "9.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Icare, https://yeswehack.com/hunters/icare"
},
{
"lang": "en",
"value": "Supr4s, https://yeswehack.com/hunters/Supr4s"
},
{
"lang": "en",
"value": "wlayzz, https://yeswehack.com/hunters/wlayzz"
},
{
"lang": "en",
"value": "truff, https://yeswehack.com/hunters/truff"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account\u0027s password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:19:55.265Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"
}
],
"title": "Kiteworks Core Authentication Bypass in the Password Reset Workflow",
"x_generator": {
"engine": "VINCE-NT 1.15.0+build.145"
}
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-102115",
"datePublished": "2026-09-30T20:19:55.265Z",
"dateReserved": "2026-09-28T17:39:13.562Z",
"dateUpdated": "2026-10-01T13:37:03.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Architecture and Design
Do not use standard weak security questions and use several security questions.
Mitigation
Architecture and Design
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Architecture and Design
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Architecture and Design
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Architecture and Design
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.