CWE-620 Unverified Password Change
baseWhen setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (119)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7378US | critical9.1 | Exploit | ||
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance… | ||||
| CVE-2006-0684US | high7.5 | Exploit | ||
change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers… | ||||
| CVE-2018-7811US | critical9.8 | — | ||
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote… | ||||
| CVE-2018-7809US | critical9.8 | — | ||
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote… | ||||
| CVE-2026-12692US | critical9.8 | — | ||
Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass.
This issue affects Enterprise Video Platform: from 3.11.0.0 befor… | ||||
| CVE-2025-6097US | critical9.8 | — | ||
A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the comp… | ||||
| CVE-2024-45647US | critical9.8 | — | ||
IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expir… | ||||
| CVE-2024-33699US | high8.8 | — | ||
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileg… | ||||
| CVE-2023-2449US | critical9.8 | — | ||
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functio… | ||||
| CVE-2023-4214US | critical9.8 | — | ||
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code… | ||||
| CVE-2023-3069US | critical9.8 | — | ||
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8. | ||||
| CVE-2024-20419US | — | Exploit | ||
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any use… | ||||
| CVE-2007-6547US | medium6.8 | Exploit | ||
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary acces… | ||||
| CVE-2026-91995US | critical9.1 | — | ||
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the cur… | ||||
| CVE-2025-71328US | high8.8OT elevated | — | ||
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section… | ||||
| CVE-2026-24443US | high8.8 | — | ||
EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change… | ||||
| CVE-2026-24440US | high8.8 | — | ||
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verificatio… | ||||
| CVE-2024-9431US | high8.8 | — | ||
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other u… | ||||
| CVE-2022-3152US | high8.8 | — | ||
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. | ||||
| CVE-2022-21934US | high8.8 | — | ||
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan