CWE-640

{
  "affected": [],
  "aliases": [
    "CVE-2018-12421"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-14T19:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.",
  "id": "GHSA-mxq8-mx56-69hw",
  "modified": "2022-05-14T03:08:36Z",
  "published": "2022-05-14T03:08:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12421"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ltb-project/self-service-password/issues/209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ltb-project/self-service-password/issues/211"
    },
    {
      "type": "WEB",
      "url": "https://lists.ltb-project.org/pipermail/ltb-announce/2018-June/000023.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-5996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-09-26T04:59:00Z",
    "severity": "HIGH"
  },
  "details": "The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 does not enforce password-length restrictions, which makes it easier for remote attackers to obtain access via a brute-force attack.",
  "id": "GHSA-mxvf-fgg2-9qxj",
  "modified": "2022-05-17T03:39:56Z",
  "published": "2022-05-17T03:39:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5996"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21990216"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/93138"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1000812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-20T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that can result in IntegriaIMS web app user accounts can be taken over. This attack appear to be exploitable via Network access to IntegriaIMS web interface . This vulnerability appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047.",
  "id": "GHSA-p55v-v4xm-jx95",
  "modified": "2022-05-14T00:53:55Z",
  "published": "2022-05-14T00:53:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000812"
    },
    {
      "type": "WEB",
      "url": "https://github.com/articaST/integriaims/commit/f2ff0ba821644acecb893483c86a9c4d3bb75047"
    },
    {
      "type": "WEB",
      "url": "https://cp270.wordpress.com/2018/05/14/war-story-password-resets"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fleetcaptain/integria-takeover"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-19632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T05:18:06Z",
    "severity": "CRITICAL"
  },
  "details": "The TranslatePress \u2013 Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the \u0027trp_get_translations_regular\u0027 AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL \u2014 including the plaintext reset key and login parameters stored in the translation dictionary table \u2014 enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator\u0027s profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.",
  "id": "GHSA-p6fq-w74v-62gm",
  "modified": "2026-08-26T18:31:51Z",
  "published": "2026-08-26T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19632"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L361"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L531"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L35"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L93"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2061"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2257"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2371"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/queries/class-query.php#L1258"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3645229/translatepress-multilingual"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4ebf09-b089-4118-a0ee-399243253f9c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-43932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-07T16:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.",
  "id": "GHSA-p776-fv6r-6vh8",
  "modified": "2025-07-08T18:31:22Z",
  "published": "2025-07-07T18:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43932"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guomaoqiu/JobCenter/issues/18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guomaoqiu/JobCenter/blob/7e7b0b2f756d66bba7e592a6c8952c78a3573d9c/app/templates/auth/email/reset_password.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-5959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-11T09:15:26Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, was found in Beijing Baichuo Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-p9h2-45x3-q6pj",
  "modified": "2024-04-09T09:31:09Z",
  "published": "2023-11-11T09:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Changboqian/cve/blob/main/reset_password_improperly.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.244992"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.244992"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.232562"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-14016"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-24T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not_found message when the provided username or email address does not match a user in the system. This can be used to enumerate users.",
  "id": "GHSA-pch6-cp5c-rvh9",
  "modified": "2024-06-05T06:30:39Z",
  "published": "2022-05-24T17:21:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14016"
    },
    {
      "type": "WEB",
      "url": "https://blog.sean-wright.com/navigate-cms"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/204.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-28T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.",
  "id": "GHSA-pf5r-8q35-xv4w",
  "modified": "2022-02-04T00:00:43Z",
  "published": "2022-01-29T00:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27654"
    },
    {
      "type": "WEB",
      "url": "https://collaborate.pega.com/discussion/pega-security-advisory-c21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "concrete5/concrete5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-28821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-01T14:00:32Z",
    "nvd_published_at": "2023-04-28T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.",
  "id": "GHSA-ph6g-6v8w-8p6m",
  "modified": "2023-05-01T14:00:32Z",
  "published": "2023-04-28T15:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28821"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concretecms/concretecms/releases"
    },
    {
      "type": "WEB",
      "url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing rate limit for password resets"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-15749"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-07T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim\u0027s account (e.g., via XSS or an unattended workstation) to change that password and address.",
  "id": "GHSA-phf3-pr25-c9c3",
  "modified": "2024-04-04T02:09:56Z",
  "published": "2022-05-24T16:58:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15749"
    },
    {
      "type": "WEB",
      "url": "https://www.contextis.com/en/resources/advisories/cve-2019-15749"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}