CVE-2021-28293

Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.

• CWE-640

• https://0xdb9.in/2021/06/07/cve-2021-28293.htmlExploit, Third Party Advisory
• https://www.seceon.com/advanced-siem-aisiemProduct, Vendor Advisory
• https://0xdb9.in/2021/06/07/cve-2021-28293.htmlExploit, Third Party Advisory
• https://www.seceon.com/advanced-siem-aisiemProduct, Vendor Advisory

Published

Jun 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28275A Denial of Service vulnerability exists in jhead 3.04 and 3…5.5
• CVE-2021-28276A Denial of Service vulnerability exists in jhead 3.04 and 3…7.5
• CVE-2021-28277A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.…7.8
• CVE-2021-28278A Heap-based Buffer Overflow vulnerability exists in jhead 3…7.8
• CVE-2021-28280CSRF + Cross-site scripting (XSS) vulnerability in search.ph…6.1
• CVE-2021-28290A cross-site scripting (XSS) vulnerability in Skoruba Identi…6.1
• CVE-2021-28294Online Ordering System 1.0 is vulnerable to arbitrary file u…9.8
• CVE-2021-28295Online Ordering System 1.0 is vulnerable to unauthenticated …7.5
• CVE-2021-28300NULL Pointer Dereference in the "isomedia/track.c" module's …9.8
• CVE-2021-28302A stack overflow in pupnp before version 1.14.5 can cause th…7.5
• CVE-2021-28305An issue was discovered in the diesel crate before 1.4.6 for…9.8
• CVE-2021-28306An issue was discovered in the fltk crate before 0.15.3 for …7.5