CWE-620 · Authentication
Unverified Password Change
104CVEs
SortMost likely exploited
104 CVEs with CWE-620 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-20419CheckCisco SSM On-Prem <= 8-202206 - Password Reset Account TakeoverCisco · Cisco Smart Software Manager On-Prem · CVSS 10 · 2024-07-17 | 10.0 | 81% | 2024-07-17 |
| CVE-2025-4322CheckMotors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account TakeoverStylemixThemes · Motors - Car Dealer, Rental & Listing WordPress theme · CVSS 9.8 · 2025-05-20 | 9.8 | 15% | 2025-05-20 |
| CVE-2024-12824CheckNokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Changescriptsbundle · Nokri – Job Board WordPress Theme · CVSS 9.8 · 2025-03-01 | 9.8 | 2.4% | 2025-03-01 |
| CVE-2024-48887A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted requestFortinet · FortiSwitch · CVSS 9.3 · 2025-04-08 | 9.3 | 16% | 2025-04-08 |
| CVE-2024-33699The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privile…LevelOne · WBR-6012 · CVSS 9.9 · 2024-10-30 | 9.9 | 11% | 2024-10-30 |
| CVE-2020-7378CRIXP OpenCRX Unverified Password ChangeCRIXP · OpenCRX · CVSS 9.1 · 2020-11-24 | 9.1 | 2.6% | 2020-11-24 |
| CVE-2024-13375Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Resetspoonthemes · Adifier System · CVSS 9.8 · 2025-01-18 | 9.8 | 1.5% | 2025-01-18 |
| CVE-2017-14005An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require t…Prominent · ProMinent MultiFLEX M10a Controller · 2017-10-17 | – | 1.4% | 2017-10-17 |
| CVE-2026-97380MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privilegesMariaDB · server · CVSS 8.8 · 2026-10-16 | 8.8 | 1.3% | 2026-10-16 |
| CVE-2021-34785Cisco BroadWorks CommPilot Application Software VulnerabilitiesCisco · Cisco BroadWorks · CVSS 6.5 · 2021-09-09 | 6.5 | 1.3% | 2021-09-09 |
| CVE-2021-34786Cisco BroadWorks CommPilot Application Software VulnerabilitiesCisco · Cisco BroadWorks · CVSS 6.5 · 2021-09-09 | 6.5 | 1.0% | 2021-09-09 |
| CVE-2022-21935Metasys password guessingJohnson Controls · Metasys ADS/ADX/OAS server · CVSS 7.5 · 2022-06-15 | 7.5 | 1.0% | 2022-06-15 |
| CVE-2023-2297Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanismcozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User… · CVSS 9.8 · 2023-04-26 | 9.8 | 1.0% | 2023-04-26 |
| CVE-2018-8916Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without veri…Synology · DiskStation Manager (DSM) · CVSS 6.3 · 2018-06-08 | 6.3 | 1.0% | 2018-06-08 |
| CVE-2022-21934Metasys Unverified Password ChangeJohnson Controls · Metasys ADS/ADX/OAS server · CVSS 8 · 2022-05-06 | 8.0 | 1.0% | 2022-05-06 |
| CVE-2023-4214AppPresser <= 4.2.5 - Insecure Password Reset Mechanismscottopolis · AppPresser – Mobile App Framework · CVSS 8.1 · 2023-11-18 | 8.1 | 0.9% | 2023-11-18 |
| CVE-2025-10159An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (…Sophos · AP6 Series Wireless Access Points · CVSS 9.8 · 2025-09-09 | 9.8 | 0.9% | 2025-09-09 |
| CVE-2022-3152Unverified Password Change in phpfusion/phpfusionphpfusion · phpfusion/phpfusion · CVSS 9.6 · 2022-09-07 | 9.6 | 0.9% | 2022-09-07 |
| CVE-2023-2449UserPro <= 5.1.1 - Insecure Password Reset MechanismUserproplugin · UserPro - Community and User Profile WordPress Plugin · CVSS 9.8 · 2023-11-22 | 9.8 | 0.9% | 2023-11-22 |
| CVE-2026-15964Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Changebritcoder · Single Sign On For TNG · CVSS 9.8 · 2026-08-01 | 9.8 | 0.9% | 2026-08-01 |
| CVE-2025-4903D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password changeD-Link · DI-7003GV2 · CVSS 5.3 · 2025-05-19 | 5.3 | 0.9% | 2025-05-19 |
| CVE-2026-91995pig before 4.1.0 Unverified Password Change via /register/passwordpig-mesh · pig · CVSS 9.1 · 2026-09-15 | 9.1 | 0.9% | 2026-09-15 |
| CVE-2025-2253IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Resetimithemes · IMITHEMES Listing · CVSS 9.8 · 2025-05-09 | 9.8 | 0.8% | 2025-05-09 |
| CVE-2021-22773A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions…Schneider-Electric · EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Pa… · 2021-07-21 | – | 0.8% | 2021-07-21 |
| CVE-2025-6097UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password changeUTT · 进取 750W · CVSS 5.3 · 2025-06-16 | 5.3 | 0.8% | 2025-06-16 |
| CVE-2026-46623OpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleOpenIdentityPlatform · OpenAM · CVSS 7.4 · 2026-09-15 | 7.4 | 0.7% | 2026-09-15 |
| CVE-2023-5844Unverified Password Change in pimcore/admin-ui-classic-bundlepimcore · pimcore/admin-ui-classic-bundle · CVSS 4.3 · 2023-10-30 | 4.3 | 0.7% | 2023-10-30 |
| CVE-2025-4606Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeoveruxper · Sala - Startup & SaaS WordPress Theme · CVSS 9.8 · 2025-07-09 | 9.8 | 0.7% | 2025-07-09 |
| CVE-2026-54176backpack/crud: MyAccountController allows changing the login email without a current-password checkLaravel-Backpack · CRUD · CVSS 6.5 · 2026-09-14 | 6.5 | 0.7% | 2026-09-14 |
| CVE-2025-22381Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password.No vendor recorded · CVSS 8.2 · 2025-10-16 | 8.2 | 0.6% | 2025-10-16 |
| CVE-2026-12692Improper Authentication in Vimesoft's Enterprise Video PlatformVimesoft Inc. · Enterprise Video Platform · CVSS 9.8 · 2026-07-17 | 9.8 | 0.6% | 2026-07-17 |
| CVE-2024-9431Improper Privilege Management in transformeroptimus/superagitransformeroptimus · transformeroptimus/superagi · CVSS 6.5 · 2025-03-20 | 6.5 | 0.6% | 2025-03-20 |
| CVE-2026-5386KMW CCTV Security Cameras Unverified Password ChangeKMW · KM-IP521 · CVSS 9.1 · 2026-05-29 | 9.1 | 0.6% | 2026-05-29 |
| CVE-2026-54801A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application cont…Siemens · CPCI85 Central Processing/Communication · CVSS 7.2 · 2026-07-09 | 7.2 | 0.6% | 2026-07-09 |
| CVE-2025-63362Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator passwor…Waveshare · Rs232/485 To Wifi Eth (b) Firmware · CVSS 9.8 · 2025-12-04 | 9.8 | 0.6% | 2025-12-04 |
| CVE-2023-3069Unverified Password Change in tsolucio/corebostsolucio · tsolucio/corebos · CVSS 7.6 · 2023-06-02 | 7.6 | 0.6% | 2023-06-02 |
| CVE-2026-86260sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changesfturing · hosp_order · CVSS 6.5 · 2026-09-07 | 6.5 | 0.6% | 2026-09-07 |
| CVE-2025-5482Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalationsunshinephotocart · Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · CVSS 8.8 · 2025-06-04 | 8.8 | 0.6% | 2025-06-04 |
| CVE-2025-4552ContiNew Admin password unverified password changeContinew · ContiNew Admin · CVSS 5.4 · 2025-05-11 | 5.4 | 0.6% | 2025-05-11 |
| CVE-2025-3603Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Updatev1rustyle · Flynax Bridge · CVSS 9.8 · 2025-04-24 | 9.8 | 0.6% | 2025-04-24 |
| CVE-2026-54175backpack/crud: Unverified password change in MyAccountController via mass assignmentLaravel-Backpack · CRUD · CVSS 7.6 · 2026-09-14 | 7.6 | 0.6% | 2026-09-14 |
| CVE-2025-4558WormHole Tech GPM - Unverified Password ChangeWormHole Tech · GPM · CVSS 9.8 · 2025-05-12 | 9.8 | 0.5% | 2025-05-12 |
| CVE-2025-70082Lantronix EDS3000PS Unverified Password ChangeLantronix · EDS3000PS series · CVSS 2.7 · 2026-03-11 | 2.7 | 0.5% | 2026-03-11 |
| CVE-2024-23637OctoPrint Unverified Password Change via Access Control SettingsOctoPrint · OctoPrint · CVSS 4.2 · 2024-01-31 | 4.2 | 0.5% | 2024-01-31 |
| CVE-2026-85591phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Changethorsten · phpMyFAQ · CVSS 7.1 · 2026-09-04 | 7.1 | 0.5% | 2026-09-04 |
| CVE-2026-24443EventSentry < 6.0.1.20 Web Reports Unverified Password ChangeNETIKUS.NET ltd · EventSentry · CVSS 8.6 · 2026-02-24 | 8.6 | 0.5% | 2026-02-24 |
| CVE-2024-26520An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbi…No vendor recorded · CVSS 9.8 · 2024-07-26 | 9.8 | 0.5% | 2024-07-26 |
| CVE-2024-12860CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeoverscriptsbundle · CarSpot – Dealership Wordpress Classified Theme · CVSS 9.8 · 2025-02-18 | 9.8 | 0.5% | 2025-02-18 |
| CVE-2026-17599Nexus Repository 3 - Unverified Onboarding State on change-admin-password EndpointSonatype · Nexus Repository 3 · CVSS 6.9 · 2026-08-07 | 6.9 | 0.5% | 2026-08-07 |
| CVE-2025-71328Flowise - Unverified Password Change via Account SettingsFlowise · Flowise · CVSS 8.3 · 2026-06-25 | 8.3 | 0.5% | 2026-06-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.