CWE-620 · 97 records
Unverified Password Change
CVEs in this class
97 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
64This week | CVE-2024-20419Weaponized | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote atcisco · smart software manager on-prem · CWE-620 | Critical10.0 | — | 80.6% | Jul 17, 2024 |
44Plan | CVE-2024-48887Proof of concept | A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwordfortinet · fortiswitch · CWE-620 | Critical9.8 | — | 15.7% | Apr 8, 2025 |
44Plan | CVE-2025-4322Proof of concept | Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeoverstylemixthemes · motors - car dealer, rental & listing wordpress theme · CWE-620 | Critical9.8 | — | 15.5% | May 20, 2025 |
40Plan | CVE-2024-12824Proof of concept | Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Changescriptsbundle · nokri – job board wordpress theme · CWE-620 | Critical9.8 | — | 2.4% | Mar 1, 2025 |
39Monitor | CVE-2024-13375No exploit | Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Resetspoonthemes · adifier system · CWE-620 | Critical9.8 | — | 1.4% | Jan 18, 2025 |
39Monitor | CVE-2023-4214No exploit | AppPresser <= 4.2.5 - Insecure Password Reset Mechanismapppresser · apppresser · CWE-620 | Critical9.8 | — | 0.9% | Nov 17, 2023 |
39Monitor | CVE-2023-2449No exploit | UserPro <= 5.1.1 - Insecure Password Reset Mechanismuserproplugin · userpro · CWE-620 | Critical9.8 | — | 0.9% | Nov 22, 2023 |
39Monitor | CVE-2026-15964Proof of concept | Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Changebritcoder · single sign on for tng · CWE-620 | Critical9.8 | — | 0.9% | Aug 1, 2026 |
39Monitor | CVE-2025-10159No exploit | An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Pointssophos · ap6 series wireless access points · CWE-620 | Critical9.8 | — | 0.9% | Sep 9, 2025 |
39Monitor | CVE-2025-2253No exploit | IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Resetimithemes · imithemes listing · CWE-620 | Critical9.8 | — | 0.8% | May 9, 2025 |
39Monitor | CVE-2025-4606Proof of concept | Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeoveruxper · sala - startup & saas wordpress theme · CWE-620 | Critical9.8 | — | 0.7% | Jul 9, 2025 |
39Monitor | CVE-2026-12692No exploit | Improper Authentication in Vimesoft's Enterprise Video Platformvimesoft inc. · enterprise video platform · CWE-620 | Critical9.8 | — | 0.6% | Jul 17, 2026 |
39Monitor | CVE-2023-3069No exploit | Unverified Password Change in tsolucio/coreboscorebos · corebos · CWE-620 | Critical9.8 | — | 0.6% | Jun 2, 2023 |
39Monitor | CVE-2025-63362No exploit | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attwaveshare · rs232\/485 to wifi eth \(b\) firmware · CWE-620 | Critical9.8 | — | 0.6% | Dec 4, 2025 |
39Monitor | CVE-2025-3603No exploit | Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Updateflynax · flynax bridge · CWE-620 | Critical9.8 | — | 0.6% | Apr 24, 2025 |
39Monitor | CVE-2024-26520No exploit | An issue in Hangzhou Xiongwei Technology Development Co., Ltd.CWE-620 | Critical9.8 | — | 0.5% | Jul 26, 2024 |
39Monitor | CVE-2024-12860No exploit | CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeovercarspot project · carspot · CWE-620 | Critical9.8 | — | 0.5% | Feb 18, 2025 |
39Monitor | CVE-2025-9286Proof of concept | Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_passwordhancock11 · appy pie connect for woocommerce · CWE-620 | Critical9.8 | — | 0.5% | Oct 3, 2025 |
39Monitor | CVE-2025-1107No exploit | Unverified password change vulnerability in Jantoimpronta · janto · CWE-620 | Critical9.9 | — | 0.4% | Feb 7, 2025 |
39Monitor | CVE-2024-12827No exploit | DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Resetscriptsbundle · dwt - directory & listing wordpress theme · CWE-620 | Critical9.8 | — | 0.4% | Jun 27, 2025 |
39Monitor | CVE-2024-45647No exploit | IBM Security Verify Access unverified password changeibm · security verify access · CWE-620 | Critical9.8 | — | 0.3% | Jan 20, 2025 |
38Monitor | CVE-2024-33699No exploit | The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminislevel1 · wbr-6012 firmware · CWE-620 | High8.8 | — | 11.2% | Oct 30, 2024 |
37Monitor | CVE-2020-7378Proof of concept | CRIXP OpenCRX Unverified Password Changeopencrx · opencrx · CWE-620 | Critical9.1 | — | 2.6% | Nov 24, 2020 |
37Monitor | CVE-2026-91995No exploit | pig before 4.1.0 Unverified Password Change via /register/passwordpig-mesh · pig · CWE-620 | Critical9.3 | — | 0.9% | Sep 15, 2026 |
37Monitor | CVE-2025-4558No exploit | WormHole Tech GPM - Unverified Password Changewormhole tech · gpm · CWE-620 | Critical9.3 | — | 0.5% | May 12, 2025 |
- CVE-2024-2041964This week
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote at
CriticalCVSS 10.0WeaponizedEPSS 81%cisco · smart software manager on-premJul 17, 2024
- CVE-2024-4888744Plan
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin password
CriticalCVSS 9.8Proof of conceptEPSS 16%fortinet · fortiswitchApr 8, 2025
- CVE-2025-432244Plan
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 16%stylemixthemes · motors - car dealer, rental & listing wordpress themeMay 20, 2025
- CVE-2024-1282440Plan
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
CriticalCVSS 9.8Proof of conceptEPSS 2%scriptsbundle · nokri – job board wordpress themeMar 1, 2025
- CVE-2024-1337539Monitor
Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset
CriticalCVSS 9.8No exploitEPSS 1%spoonthemes · adifier systemJan 18, 2025
- CVE-2023-421439Monitor
AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
CriticalCVSS 9.8No exploitEPSS 1%apppresser · apppresserNov 17, 2023
- CVE-2023-244939Monitor
UserPro <= 5.1.1 - Insecure Password Reset Mechanism
CriticalCVSS 9.8No exploitEPSS 1%userproplugin · userproNov 22, 2023
- CVE-2026-1596439Monitor
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
CriticalCVSS 9.8Proof of conceptEPSS 1%britcoder · single sign on for tngAug 1, 2026
- CVE-2025-1015939Monitor
An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points
CriticalCVSS 9.8No exploitEPSS 1%sophos · ap6 series wireless access pointsSep 9, 2025
- CVE-2025-225339Monitor
IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset
CriticalCVSS 9.8No exploitEPSS 1%imithemes · imithemes listingMay 9, 2025
- CVE-2025-460639Monitor
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 1%uxper · sala - startup & saas wordpress themeJul 9, 2025
- CVE-2026-1269239Monitor
Improper Authentication in Vimesoft's Enterprise Video Platform
CriticalCVSS 9.8No exploitEPSS 1%vimesoft inc. · enterprise video platformJul 17, 2026
- CVE-2023-306939Monitor
Unverified Password Change in tsolucio/corebos
CriticalCVSS 9.8No exploitEPSS 1%corebos · corebosJun 2, 2023
- CVE-2025-6336239Monitor
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows att
CriticalCVSS 9.8No exploitEPSS 1%waveshare · rs232\/485 to wifi eth \(b\) firmwareDec 4, 2025
- CVE-2025-360339Monitor
Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update
CriticalCVSS 9.8No exploitEPSS 1%flynax · flynax bridgeApr 24, 2025
- CVE-2024-2652039Monitor
An issue in Hangzhou Xiongwei Technology Development Co., Ltd.
CriticalCVSS 9.8No exploitEPSS 1%Jul 26, 2024
- CVE-2024-1286039Monitor
CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover
CriticalCVSS 9.8No exploitEPSS 0%carspot project · carspotFeb 18, 2025
- CVE-2025-928639Monitor
Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password
CriticalCVSS 9.8Proof of conceptEPSS 0%hancock11 · appy pie connect for woocommerceOct 3, 2025
- CVE-2025-110739Monitor
Unverified password change vulnerability in Janto
CriticalCVSS 9.9No exploitEPSS 0%impronta · jantoFeb 7, 2025
- CVE-2024-1282739Monitor
DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset
CriticalCVSS 9.8No exploitEPSS 0%scriptsbundle · dwt - directory & listing wordpress themeJun 27, 2025
- CVE-2024-4564739Monitor
IBM Security Verify Access unverified password change
CriticalCVSS 9.8No exploitEPSS 0%ibm · security verify accessJan 20, 2025
- CVE-2024-3369938Monitor
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminis
HighCVSS 8.8No exploitEPSS 11%level1 · wbr-6012 firmwareOct 30, 2024
- CVE-2020-737837Monitor
CRIXP OpenCRX Unverified Password Change
CriticalCVSS 9.1Proof of conceptEPSS 3%opencrx · opencrxNov 24, 2020
- CVE-2026-9199537Monitor
pig before 4.1.0 Unverified Password Change via /register/password
CriticalCVSS 9.3No exploitEPSS 1%pig-mesh · pigSep 15, 2026
- CVE-2025-455837Monitor
WormHole Tech GPM - Unverified Password Change
CriticalCVSS 9.3No exploitEPSS 1%wormhole tech · gpmMay 12, 2025