When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
88 vulnerabilities with CWE-620
CVE-2025-62425
HIGH
matrix-authentication-service 0.20.0-1.4.0 - Authenticated Unverified Password Change
CVSS 8.3
CVE-2025-61536
HIGH
FelixRiddle dev-jobs-handlebars 1.0 - Info Disclosure
CVSS 8.2
CVE-2025-22381
HIGH
Aggie 2.6.1 - Unauthenticated Password Reset via Host Header Injection
CVSS 8.2
CVE-2025-9286
CRITICAL
Appy Pie Connect <1.1.2 - Privilege Escalation
CVSS 9.8
CVE-2025-10159
CRITICAL
Sophos AP6 Series Wireless Access Points < 1.7.2563 (MR7) - Authentication Bypass
CVSS 9.8
CVE-2025-46389
MEDIUM
Emby/MediaBrowser >=4.9.0.35 - Unverified Password Change
CVSS 6.5
CVE-2025-4606
CRITICAL
Uxper Sala - Startup & SaaS WordPress Theme <=1.1.4 - Privilege Escalation via Account Takeover
CVSS 9.8
CVE-2025-6097
MEDIUM
UTT 750W < 5.0 - Unauthenticated Unverified Password Change via formDefineManagement
CVSS 5.3
CVE-2025-5482
HIGH
Sunshine Photo Cart < 3.4.12 - Authenticated Privilege Escalation via Password Reset Key Validation Bypass
CVSS 8.8
CVE-2025-47938
LOW
TYPO3 <9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.1...
CVSS 3.8
CVE-2025-4322
CRITICAL
Motors WordPress <5.6.67 - Privilege Escalation
CVSS 9.8
CVE-2025-4903
MEDIUM
D-Link DI-7003GV2 24.04.18D1 R(68125) - Unauthenticated Unverified Password Change via webgl.asp
CVSS 5.3
CVE-2025-46748
LOW
SEL Blueframe OS < 1.10.0 - Authenticated Unverified Password Change
CVSS 2.7
CVE-2025-4558
CRITICAL
WormHole Tech GPM < 202502 - Unauthenticated Unverified Password Change
CVSS 9.8
CVE-2025-4552
MEDIUM
ContiNew Admin < 3.6.0 - Unauthenticated Unverified Password Change via /dev-api/system/user/1/password
CVSS 5.4
CVE-2025-2253
CRITICAL
IMITHEMES Listing <3.3 - Privilege Escalation
CVSS 9.8
CVE-2025-3793
MEDIUM
Buddypress Force Password Change <0.1 - Privilege Escalation
CVSS 4.2
CVE-2025-3607
HIGH
Frontend Login & Registration Blocks <1.0.7 - Privilege Escalation
CVSS 8.8
CVE-2025-3603
CRITICAL
Flynax Bridge < 2.2.0 - Unauthenticated Privilege Escalation via Password Change
CVSS 9.8
CVE-2025-3849
MEDIUM
SpringBoot-Vue-OnlineExam 1.0 - Unverified Password Change via studentId Parameter
CVSS 4.3
CVE-2025-1107
CRITICAL
Janto < r12 - Unauthenticated Unverified Password Change via Gateway.php Endpoint
CVSS 9.9
CVE-2024-12827
CRITICAL
DWT - Directory & Listing WordPress Theme <3.3.6 - Privilege Escala...
CVSS 9.8
CVE-2024-47784
LOW
ABB ANC < 1.1.4 - Authenticated Unverified Password Change via Web HMI
CVSS 2.6
CVE-2024-48887
CRITICAL
FortiSwitch >=6.4.0 <6.4.15 - Unauthenticated Password Change via GUI Request
CVSS 9.8
CVE-2024-41796
MEDIUM
SENTRON 7KT PAC1260 Data Manager - Unauthenticated Password Change via Web Interface
CVSS 6.5
Details
Vulnerabilities
88