CVEvulnerability

CVE-2025-1107

9.9 CRITICAL Published 2025-02-07 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-02-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Weaknesses
CWE-620

Description

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.

Related

Weakness · CWE (1)

  • CWE-620 Unverified Password Change weakness

References