CVE WatchJul 5, 2026

CVE-2025-50674

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing

CVSS

7.8

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Aug 22, 2025 · Last modified: Jul 5, 2026 · CWE-20 · CWE-269

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-06-302026-07-17

Technical description

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2026-125699.8 CRI

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability17d CVE-2026-468179.8 CRI

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability2d CVE-2025-607877.2 HIG

97.0%

——29MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.13d CVE-2022-250899.8 CRI

96.9%

——29Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.9d CVE-2017-149197.5 HIG

94.3%

——28Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.3d