CVE-2026-115973
High · 7.3CVSS
7.3
EPSS
0.3%
Published
Oct 24, 2026
CISA due date
—
The record
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login… CWE-640
- CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-640
- CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
- CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
- CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. CWE-640
- CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes… CWE-640
- CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges… CWE-640
- CVE-2026-82487 A vulnerability was determined in Beetel 450TC3 01.00.00_01. CWE-640