https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:04:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-258516 EUVD-2026-258516 https://cve.radiocsirt.org/vuln/euvd-2026-258516 https://cve.radiocsirt.org/vuln/fkie_cve-2024-11717 <p>Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user&#39;s password and take over the account. Moreover, the tokens also include base64 encoded user email.</p> <p>This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.</p> <p>Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user&#39;s password and take over the account. Moreover, the tokens also include base64 encoded user email.</p> <p>This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-11717 https://cve.radiocsirt.org/vuln/ghsa-9w6g-7jpw-87hf <p>Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user&#39;s password and take over the account. Moreover, the tokens also include base64 encoded user email.</p> <p>This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.</p> <p>Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user&#39;s password and take over the account. Moreover, the tokens also include base64 encoded user email.</p> <p>This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.</p> https://cve.radiocsirt.org/vuln/ghsa-9w6g-7jpw-87hf