CVE-2026-2543CWE-620CWE-640

vichan-devel vichan Password Change pages.php unverified password change

Medium · published February 16, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverified password change. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00428 · 36.0th percentile
Weaknesses
CWE-620 · Unverified Password Change; CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-02-16T07:02Z
EPSS history
Timeline
  • 16 FEB 07:02Z
    vichan-devel vichan Password Change pages.php unverified password change
    cvelistv5