CVE-2024-0425: ForU CMS password recovery

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-11 · updated 2026-06-17
Weakness: CWE-640

Description

A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.

Affected products

ForU CMS: through 2020-06-23

References

https://github.com/mi2acle/forucmsvuln/blob/master/passwordreset.md
https://vuldb.com/?ctiid.250444
https://vuldb.com/?id.250444
https://github.com/mi2acle/forucmsvuln/blob/master/passwordreset.md
https://vuldb.com/?ctiid.250444
https://vuldb.com/?id.250444

Get alerted when CVE-2024-0425 or the next vulnerability affects your stack