{"id":"CVE-2026-2543","state":"PUBLISHED","title":"vichan-devel vichan Password Change pages.php unverified password change","description":"A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverified password change. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-02-16T07:02:06.623Z","updatedAt":"2026-02-23T10:06:50.195Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["vichan-devel vichan"],"affected":[{"vendor":"vichan-devel","product":"vichan","versions":[{"version":"5.1.0","status":"affected"},{"version":"5.1.1","status":"affected"},{"version":"5.1.2","status":"affected"},{"version":"5.1.3","status":"affected"},{"version":"5.1.4","status":"affected"},{"version":"5.1.5","status":"affected"}],"modules":["Password Change Handler"]}],"references":["https://vuldb.com/?id.346152","https://vuldb.com/?ctiid.346152","https://vuldb.com/?submit.749716","https://github.com/lakshayyverma/CVE-Discovery/blob/main/vichan.md"],"weaknesses":["CWE-620","CWE-640"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2543.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2543","state":"PUBLISHED","datePublished":"2026-02-16T07:02:06.623Z","dateUpdated":"2026-02-23T10:06:50.195Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-02-15T15:51:48.549Z"},"containers":{"cna":{"title":"vichan-devel vichan Password Change pages.php unverified password change","descriptions":[{"lang":"en","value":"A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverified password change. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"vichan-devel","product":"vichan","versions":[{"version":"5.1.0","status":"affected"},{"version":"5.1.1","status":"affected"},{"version":"5.1.2","status":"affected"},{"version":"5.1.3","status":"affected"},{"version":"5.1.4","status":"affected"},{"version":"5.1.5","status":"affected"}],"modules":["Password Change Handler"]}],"references":[{"url":"https://vuldb.com/?id.346152","name":"VDB-346152 | vichan-devel vichan Password Change pages.php unverified password change","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.346152","name":"VDB-346152 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.749716","name":"Submit #749716 | Vichan Devel Vichan  5.1.5 Unverified Password Change","tags":["third-party-advisory"]},{"url":"https://github.com/lakshayyverma/CVE-Discovery/blob/main/vichan.md","tags":["related"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:ND/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-620","type":"CWE","lang":"en","description":"Unverified Password Change"}]},{"descriptions":[{"cweId":"CWE-640","type":"CWE","lang":"en","description":"Weak Password Recovery"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-02-23T10:06:50.195Z"},"timeline":[{"time":"2026-02-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-02-15T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-02-20T07:24:21.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"lakshay12311 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-17T21:04:24.388259Z","id":"CVE-2026-2543","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-17T21:04:34.109Z"}}]}}}