CWE-640

272 vulnerabilities with CWE-640

CVE-2025-12866 CRITICAL

Hundred Plus EIP Plus < RELEASE_240626 - Unauthenticated Weak Password Recovery Mechanism

CVSS 9.8

CVE-2025-64101 HIGH

Zitadel < 2.71.18 - Open Redirect via Password Reset Forwarded Header

CVSS 8.1

CVE-2025-61977 HIGH

Productivity Suite <v4.4.1.19 - Info Disclosure

CVSS 7.0

CVE-2025-56748 MEDIUM

Academy LMS <= 5.13 - Weak Password Recovery Mechanism via Predictable Reset Tokens

CVSS 6.4

CVE-2025-41251 HIGH

VMware NSX/NSX-T/Cloud Foundation Unauthenticated Username Enumeration via Weak Password Recovery

CVSS 8.1

CVE-2025-10322 MEDIUM

Wavlink WL-WN578W2 221110 - Weak Password Recovery Mechanism via sysinit.html newpass/confpass Parameters

CVSS 5.3

CVE-2025-10127 CRITICAL

Daikin Europe N.V Security Gateway - Unauthenticated Authorization Bypass via User-Controlled Key

CVSS 9.8

CVE-2025-32486 CRITICAL

Hossein Material Dashboard <1.4.6 - Info Disclosure

CVSS 9.8

CVE-2025-50503 HIGH

Touch Lebanon Mobile App 2.20.2 - Auth Bypass

CVSS 8.8

CVE-2025-55030 MEDIUM

Firefox for iOS < 142 - Cross-Site Scripting via Content-Disposition Header Bypass

CVSS 6.1

CVE-2025-50594 CRITICAL

Danphe Health Hospital Management System EMR <3.2 - Privilege Escal...

CVSS 9.8

CVE-2025-7948 MEDIUM

jshERP <3.5 - Weak Password Recovery

CVSS 4.3

CVE-2025-7881 LOW

Mercusys MW301R 1.0.2 Build 190726 Rel.59423n - Weak Password Recovery

CVSS 2.7

CVE-2025-53373 HIGH

Natours Password Reset - Host Header Account Takeover

CVE-2025-43932 CRITICAL

JobCenter <7e7b0b2 - Privilege Escalation

CVSS 9.8

CVE-2025-43931 CRITICAL

flask-boilerplate <a170e7c - Auth Bypass

CVSS 9.8

CVE-2025-52560 HIGH

Kanboard < 1.2.46 - Unauthenticated Password Reset Token Leak via Host Header

CVSS 8.1

CVE-2025-6216 CRITICAL

Allegra 7.0.0-7.5.2.70 - Unauthenticated Authentication Bypass via Password Recovery Token

CVSS 9.8

CVE-2025-6097 MEDIUM

UTT 750W < 5.0 - Unauthenticated Unverified Password Change via formDefineManagement

CVSS 5.3

CVE-2025-47646 CRITICAL

Gilblas Ngunte Possi PSW Front-end Login & Registration <1.13 - Inf...

CVSS 9.8

CVE-2025-4903 MEDIUM

D-Link DI-7003GV2 24.04.18D1 R(68125) - Unauthenticated Unverified Password Change via webgl.asp

CVSS 5.3

CVE-2025-4552 MEDIUM

ContiNew Admin < 3.6.0 - Unauthenticated Unverified Password Change via /dev-api/system/user/1/password

CVSS 5.4

CVE-2025-3849 MEDIUM

SpringBoot-Vue-OnlineExam 1.0 - Unverified Password Change via studentId Parameter

CVSS 4.3

CVE-2025-31380 CRITICAL

Paid Videochat Turnkey Site <7.3.11 - Info Disclosure

CVSS 9.8

CVE-2025-29995 HIGH

CAP Back Office - Privilege Escalation