CVE-2022-44004

CRITICAL

BACKCLICK Professional <5.9.63 - Auth Bypass

Title source: llm

Description

An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.

References (2)

[Exploit, Third Party Advisory] https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-030.txt

[Third Party Advisory] https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037

Scores

CVSS v3 9.8

EPSS 0.0157

EPSS Percentile 81.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-640

Status published

Affected Products (1)

backclick/backclick

Timeline

Published Nov 16, 2022

Tracked Since Feb 18, 2026