CWE-620

CWE-620 · 3 records · 3 with a public proof-of-concept

Records the NVD classes under CWE-620, highest CVSS first.

  1. HIGH 8.3CVE-2026-92467public PoC2026-09-16

    zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an…

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 4.8CVE-2026-105785public PoC2026-10-06

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without …

    AI risk analysis on Exploit-DB.ai →

  3. UNSCOREDCVE-2026-102603public PoC2026-10-13

    Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another …

    AI risk analysis on Exploit-DB.ai →