CVE Watch12 de nov. de 2026

CVE-2026-110951

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Te

CVSS

7.5

Alta

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-640

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation. This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.

Referências oficiais

siberguvenlik.gov.trhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1261509.1 CRÍ

—

——0A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.8h CVE-2026-1187418.1 ALT

55.6%

——17Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.2d CVE-2026-600467.5 ALT

24.9%

——7An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.8h CVE-2026-1250747.3 ALT

22.3%

——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.8h CVE-2026-118459—

25.6%

——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.8h CVE-2026-1231968.1 ALT

29.8%

——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.3d