When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
88 vulnerabilities with CWE-620
CVE-2026-12692
CRITICAL
Improper Authentication in Vimesoft's Enterprise Video Platform
CVSS 9.8
CVE-2026-56305
HIGH
Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
CVSS 8.3
CVE-2026-54801
HIGH
Siemens CPCI85 Central Processing/Communication - Unverified Password Change
CVSS 7.2
CVE-2026-44733
MEDIUM
OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
CVSS 5.9
CVE-2026-5386
CRITICAL
KMW KM-IP521 - KMW CCTV Security Cameras Unverified Password Change
CVSS 9.1
CVE-2026-9249
LOW
Devolutions Server - Unverified Password Change
CVSS 3.1
CVE-2026-8327
MEDIUM
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.
CVSS 4.3
CVE-2026-42084
HIGH
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
CVSS 8.1
CVE-2026-40588
HIGH
blueprintUE: Authenticated Password Change Does Not Verify Current Password
CVSS 8.1
CVE-2026-30458
CRITICAL
FuelCMS 1.5.2 - Unauthenticated Account Takeover via Password Reset Token Exfiltration
CVSS 9.1
CVE-2026-27757
HIGH
SODOLA SL902-SWTGW124AS <200.1.20 - Auth Bypass
CVSS 7.1
CVE-2026-24443
HIGH
EventSentry <6.0.1.20 - Auth Bypass
CVSS 8.8
CVE-2026-2543
LOW
vichan-devel vichan <5.1.5 - Auth Bypass
CVSS 2.7
CVE-2026-24440
HIGH
Shenzhen Tenda W30E V2 - Info Disclosure
CVSS 8.8
CVE-2025-71328
HIGH
Flowise - Unverified Password Change via Account Settings
CVSS 8.3
CVE-2025-71337
HIGH
Flowise - Unverified Email Change via Account Profile Endpoint
CVSS 8.3
CVE-2025-70082
CRITICAL
Lantronix EDS3000PS 3.1.0.0R2 - Code Injection
CVSS 9.8
CVE-2025-67041
CRITICAL
Lantronix EDS3000PS 3.1.0.0R2 - Command Injection
CVSS 9.8
CVE-2025-14751
HIGH
Product - Privilege Escalation
CVE-2025-11235
LOW
Progress MOVEit Transfer <2023.1.3-2022.0.10 - Unverified Password ...
CVSS 3.7
CVE-2025-13148
HIGH
IBM Aspera Orchestrator <4.1.0 - Privilege Escalation
CVSS 8.1
CVE-2025-67719
HIGH
Ibexa <5.0.3 - Privilege Escalation
CVE-2025-59808
MEDIUM
Fortinet FortiSOAR <7.6.2 - Info Disclosure
CVSS 6.8
CVE-2025-63362
CRITICAL
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gatewa...
CVSS 9.8
CVE-2025-61132
HIGH
levlaz braindump <0.4.14 - Host Header Injection
CVSS 7.1
Details
Vulnerabilities
88