Description
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.
Remediation
References
Related Vulnerabilities
WordPress Plugin BackWPup Unspecified Vulnerability (3.3)
WordPress Plugin HTML5 MP3 Player with Playlist Free Information Disclosure (2.6)
Grafana Other Vulnerability (CVE-2021-28147)
SharePoint CVE-2020-0975 Vulnerability (CVE-2020-0975)
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2011-4133)