GHSA-x93p-w2ch-fg67
NoneCVSS
—
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
Ibexa User Bundle is missing password change validation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | ibexa/user | 5.0.0-beta1 | 5.0.4 |
| packagist | ibexa/user | 5.0.0-beta1 | 5.0.4 |
Related vulnerabilities
- CVE-2025-67719 Ibexa is a composable end-to-end DXP (Digital Experience Platform). Same vulnerability
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
- CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-620
- CVE-2026-44733 OpenProject is open-source, web-based project management software. CWE-620
- CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability. CWE-620
- CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email… CWE-620