CVE-2025-70082
Low · 2.7CVSS
2.7
EPSS
0.5%
Published
Mar 11, 2026
CISA due date
—
The record
The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
- CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-620
- CVE-2026-44733 OpenProject is open-source, web-based project management software. CWE-620
- CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability. CWE-620
- CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email… CWE-620
- CVE-2026-5386 The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated… CWE-620