CVE-2025-1107 — Unverified password change vulnerability in Janto
Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their cu…
Published: 2025-02-07 · CVSS: 9.9 · CVSS 3.1
Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7