Threats tagged 'ghsa-v6wm-53cp-jr8q'

WonderCMS versions before 3.7.0 have a vulnerability in the saveAction functionality that allows an authenticated user to change the administrator password without needing to re-authenticate. This missing re-verification step can be exploited by attackers with existing authenticated access to bypass controls designed to prevent unauthorized password changes.