CVE-2016-9479

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Dec 2, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-94809.1libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed CVE-2016-94819.8In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The methCVE-2016-94829.8Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administratorCVE-2016-94839.8The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remotCVE-2016-94847.5The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform CVE-2016-94857.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94867.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94877.8EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supCVE-2016-94889.8ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticatedCVE-2016-94898.8In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, incluCVE-2016-94906.1ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. ApplicatCVE-2016-94914.9ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most l
CVE-2016-9479: High severity, CVSS 7.5 | Vulnix