CWE-640 · Authentication
Weak Password Recovery Mechanism for Forgotten Password
313CVEs
1exploited
5with a public check
3likely (EPSS 10%+)
SortMost likely exploited
313 CVEs with CWE-640 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-7028In CISA KEVExploitedGitLab - Account Takeover via Password ResetGitLab · GitLab · CVSS 10 · 2024-01-12 | 10.0 | 94% | 2024-01-12 |
| CVE-2019-18818Checkstrapi CMS <3.0.0-beta.17.5 - Admin Password ResetStrapi · Strapi · 2019-11-07 | – | 97% | 2019-11-07 |
| CVE-2017-7615CheckMantisBT <=2.30 - Arbitrary Password Reset/Admin AccessMantisbt · Mantisbt · 2017-04-16 | – | 91% | 2017-04-16 |
| CVE-2025-47646CheckPSW Front-end Login & Registration 1.13 - Weak Password RecoveryGilblas Ngunte Possi · PSW Front-end Login & Registration · CVSS 9.8 · 2025-05-23 | 9.8 | 25% | 2025-05-23 |
| CVE-2026-18963CheckKeycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials BypassRed Hat · Red Hat build of Keycloak 26.4 · CVSS 9.1 · 2026-08-18 | 9.1 | 8.1% | 2026-08-18 |
| CVE-2026-19632CheckTranslatePress <= 3.3.1 - Unauthenticated Account Takeovercozmoslabs · TranslatePress – Translate Multilingual sites with AI Translation · CVSS 9.8 · 2026-08-26 | 9.8 | 4.5% | 2026-08-26 |
| CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after ca…Djangoproject · Django · 2019-12-18 | – | 54% | 2019-12-18 |
| CVE-2025-6216Allegra calculateTokenExpDate Password Recovery Authentication Bypass VulnerabilityAllegra · Allegra · CVSS 9.8 · 2025-06-21 | 9.8 | 48% | 2025-06-21 |
| CVE-2017-8295WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a cra…Wordpress · Wordpress · 2017-05-04 | – | 27% | 2017-05-04 |
| CVE-2018-0787ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core E…Microsoft Corporation · ASP.NET Core · 2018-03-14 | – | 9.6% | 2018-03-14 |
| CVE-2017-5594An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled.…Pagekit · Pagekit · 2017-01-25 | – | 7.0% | 2017-01-25 |
| CVE-2017-17097gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with…Gps-Server · Gps Tracking Software · 2018-01-02 | – | 6.9% | 2018-01-02 |
| CVE-2015-7257ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an out…Zte · Zxv10 W300 Firmware · 2017-08-24 | – | 6.7% | 2017-08-24 |
| CVE-2012-5686ZPanel 10.0.1 has insufficient entropy for its password reset process.Zpanelcp · Zpanel · 2020-02-04 | – | 4.8% | 2020-02-04 |
| CVE-2014-6412WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.Wordpress · Wordpress · 2018-04-12 | – | 4.6% | 2018-04-12 |
| CVE-2022-29933Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a…Craftcms · Craft Cms · 2022-05-09 | – | 4.6% | 2022-05-09 |
| CVE-2018-19488The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote una…Wp-Jobhunt Project · Wp-Jobhunt · 2019-03-17 | – | 4.2% | 2019-03-17 |
| CVE-2020-28186Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.Terra-Master · Tos · 2020-12-24 | – | 4.1% | 2020-12-24 |
| CVE-2017-8613Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged…Microsoft Corporation · Azure AD Connect · 2017-06-29 | – | 3.6% | 2017-06-29 |
| CVE-2018-7811An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remot…Schneider Electric SE · Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 · 2018-11-30 | – | 3.5% | 2018-11-30 |
| CVE-2026-12571Authentication Bypass Leading to Account Takeoverzohocorp · manageengine_ddi_central · CVSS 9.8 · 2026-08-11 | 9.8 | 3.3% | 2026-08-11 |
| CVE-2018-11134In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges an…Quest · Kace System Management Appliance · 2018-05-31 | – | 2.9% | 2018-05-31 |
| CVE-2018-12421LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind re…Ltb-Project · Ldap Tool Box Self Service Password · 2018-06-14 | – | 2.7% | 2018-06-14 |
| CVE-2018-7809An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remot…Schneider Electric SE · Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 · 2018-11-30 | – | 2.5% | 2018-11-30 |
| CVE-2015-4689Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."Ellucian · Banner Student · 2017-09-11 | – | 2.3% | 2017-09-11 |
| CVE-2019-11393An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password chan…Tildeslash · Monit · 2019-04-21 | – | 2.1% | 2019-04-21 |
| CVE-2018-1000812Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password reco…Artica · Integria Ims · 2018-12-20 | – | 2.0% | 2018-12-20 |
| CVE-2021-22763A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see secur…Schneider-Electric · PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (… · CVSS 9.8 · 2021-06-11 | 9.8 | 1.9% | 2021-06-11 |
| CVE-2009-5025A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.PyForum · PyForum · 2020-01-15 | – | 1.8% | 2020-01-15 |
| CVE-2018-17298An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.Enalean · Tuleap · 2018-09-21 | – | 1.8% | 2018-09-21 |
| CVE-2019-15929In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.Craftcms · Craft Cms · 2019-10-24 | – | 1.8% | 2019-10-24 |
| CVE-2019-13240An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any…Glpi-Project · Glpi · 2019-07-10 | – | 1.7% | 2019-07-10 |
| CVE-2022-23855An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to res…Saviynt · Enterprise Identity Cloud · 2022-01-24 | – | 1.7% | 2022-01-24 |
| CVE-2020-27408OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbi…Os4ed · Opensis · 2020-12-04 | – | 1.7% | 2020-12-04 |
| CVE-2018-18871Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to c…Gigasetpro · Maxwell Basic Firmware · 2018-12-20 | – | 1.7% | 2018-12-20 |
| CVE-2018-16988An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5…Buffalo · Open Xdmod · 2019-05-02 | – | 1.6% | 2019-05-02 |
| CVE-2021-43498An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.Atutor · Atutor · 2022-04-08 | – | 1.6% | 2022-04-08 |
| CVE-2021-28293Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to rec…Seceon · Aisiem · 2021-06-08 | – | 1.6% | 2021-06-08 |
| CVE-2017-2766EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includ…Emc · EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom v… · 2017-02-03 | – | 1.6% | 2017-02-03 |
| CVE-2020-14016An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated…Naviwebs · Navigate Cms · 2020-06-24 | – | 1.6% | 2020-06-24 |
| CVE-2018-1000501Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack ap…Instant-Update · Instant Update Cms · 2018-06-26 | – | 1.6% | 2018-06-26 |
| CVE-2018-16529A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has…Forcepoint · Forcepoint Email Security · 2019-03-28 | – | 1.6% | 2019-03-28 |
| CVE-2018-10081CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e"…Cmsmadesimple · Cms Made Simple · 2018-04-13 | – | 1.5% | 2018-04-13 |
| CVE-2019-12476An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a s…Zohocorp · Manageengine Adselfservice Plus · 2019-06-17 | – | 1.5% | 2019-06-17 |
| CVE-2018-17881On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.D-Link · Dir-823g Firmware · 2018-10-03 | – | 1.5% | 2018-10-03 |
| CVE-2022-44004An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for a…Backclick · Backclick · CVSS 9.8 · 2022-11-16 | 9.8 | 1.5% | 2022-11-16 |
| CVE-2022-29174Predictable password reset token may lead to account takeover in countly-serverCountly · countly-server · CVSS 8.1 · 2022-05-17 | 8.1 | 1.5% | 2022-05-17 |
| CVE-2021-33321Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password f…Liferay · Dxp · 2021-08-03 | – | 1.4% | 2021-08-03 |
| CVE-2021-22731Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized passwo…Schneider-Electric · Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior · 2021-05-26 | – | 1.4% | 2021-05-26 |
| CVE-2016-5996The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.…Ibm · Tealeaf Customer Experience · 2016-09-26 | – | 1.4% | 2016-09-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.