CWE-640: Weak Password Recovery Mechanism for Forgotten Password, page 4
Filter
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
What the weakness is: CWE-640 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-640, as MITRE names them. Credits.
Ask an AI about CWE-640
Show the prompt
Explain CWE-640: Weak Password Recovery Mechanism for Forgotten Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/640.html and https://cve.bz/cve/cwe/640?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2025-43931EPSS 0.4%
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
- 8.8CVE-2025-52560EPSS 0.5%
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configura…
- 9.8CVE-2025-6216EPSS 48%
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this v…
- 5.5CVE-2025-6097EPSS 0.7%
A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of t…
- 9.8CVE-2025-47646ExploitEPSS 25%
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Regi…
- 6.9CVE-2025-4903EPSS 0.9%
A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This affects the function sub_41F4F0 of the file /H5/webgl.asp?tggl_port=0&remote_management=0&http_passwd=game&exec_service=admin-resta…
- 5.3CVE-2025-4552EPSS 0.6%
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified passwo…
- 5.3CVE-2025-3849EPSS 0.4%
A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password chan…
- 9.8CVE-2025-31380EPSS 0.6%
Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Password Recovery Exploitation.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.…
- 8.8CVE-2024-12295EPSS 0.4%
The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0. This is due to the plugin not properly validating a user's identity prior to updating…
- 8.3CVE-2025-29995EPSS 0.4%
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable AP…
- 6.5CVE-2024-12604EPSS 0.2%
Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misus…
- 2.3CVE-2025-2093EPSS 0.4%
A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argumen…
- 9.8CVE-2025-1570EPSS 0.4%
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_ge…
- 5.4CVE-2025-1231EPSS 0.4%
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
- 9.0CVE-2025-22144EPSS 0.8%
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is success…
- 6.9CVE-2025-0331EPSS 0.5%
A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. T…
- 9.8CVE-2024-11350EPSS 0.7%
The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password t…
- 9.8CVE-2024-53552EPSS 0.8%
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
- 9.3CVE-2024-47547EPSS 0.7%
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.
- 9.8CVE-2024-11103EPSS 0.8%
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their p…
- 8.1CVE-2024-45670EPSS 0.3%
IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.
- 0.0CVE-2024-50356EPSS 0.4%
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even tho…
- 9.8CVE-2024-48428EPSS 0.8%
An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.
- 9.8CVE-2024-9302EPSS 0.6%
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() a…
- 9.8CVE-2024-9305EPSS 0.7%
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() funct…
- 6.3CVE-2024-9907EPSS 0.4%
A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation lead…
- 8.8CVE-2024-45980EPSS 0.4%
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compr…
- 10.0CVE-2024-8878EPSS 1.3%
The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.
- 6.9CVE-2024-8692EPSS 0.5%
A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The explo…
- 8.0CVE-2024-42915EPSS 0.4%
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' p…
- 8.1CVE-2024-6203EPSS 0.4%
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.…
- 9.8CVE-2024-38287EPSS 0.5%
The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit v…
- 8.1CVE-2024-6125EPSS 0.5%
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has…
- 9.8CVE-2024-38468EPSS 0.4%
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.
- 9.8CVE-2023-7264EPSS 0.6%
The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of …
- 6.5CVE-2024-36407EPSS 0.3%
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new passw…
- 7.5CVE-2024-5277EPSS 0.4%
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the p…
- 9.8CVE-2024-5404EPSS 0.5%
An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.
- 8.8CVE-2023-35717EPSS 0.6%
TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not require…
- 7.5CVE-2024-33530EPSS 0.8%
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
- 8.8CVE-2024-27899EPSS 0.4%
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause …
- 9.8CVE-2024-2862ExploitEPSS 51%
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
- 8.0CVE-2024-2463EPSS 0.6%
Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1.
- 8.0CVE-2024-24903EPSS 0.4%
Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unaut…
- 6.3CVE-2021-29038EPSS 0.3%
Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attack…
- 8.8CVE-2024-22454EPSS 0.6%
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized a…
- 7.5CVE-2024-0491EPSS 0.6%
A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is…
- 9.8CVE-2023-7028KEVExploitEPSS 94%
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which …
- 7.5CVE-2024-0425EPSS 0.7%
A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be in…