CVE Catalog
CVE-2016-9479
HighSummary
The 'lost password' functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
Risk Assessment
Attackers can gain access to user accounts, potentially leading to data breaches and privacy violations.
Recommendation
It is recommended to update b2evolution to version 6.7.9 or later to mitigate this vulnerability.
Other vulnerabilities in b2evolution
Original NVD description (English source)
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.