| Package | Affected versions | Patched versions |
|---|---|---|
| gestsup | < 3.2.10 | 3.2.10 |
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP uniqueid function), allowing a brute force attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free