CVE WatchNov 12, 2026

CVE-2026-110951

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Te

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-640

EPSS · 30d

Not enough EPSS history yet.

Technical description

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation. This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.

Official references

siberguvenlik.gov.trhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1261509.1 CRI

—

——0A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.8h CVE-2026-1187418.1 HIG

55.6%

——17Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.2d CVE-2026-600467.5 HIG

24.9%

——7An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.7h CVE-2026-1250747.3 HIG

22.3%

——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.8h CVE-2026-118459—

25.6%

——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.7h CVE-2026-1231968.1 HIG

29.8%

——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.3d