CVE-2025-1107

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.

• CWE-620

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto

Published

Feb 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11064A security flaw has been discovered in Campcodes Online Lear…9.8
• CVE-2025-11065A flaw was found in github.com/go-viper/mapstructure/v2, in …5.3
• CVE-2025-11066A flaw has been found in code-projects Online Bidding System…9.8
• CVE-2025-11067A vulnerability has been found in Projectworlds Visitor Mana…4.8
• CVE-2025-11068A vulnerability was found in westboy CicadasCMS 1.0. Affecte…4.8
• CVE-2025-11069A vulnerability was determined in westboy CicadasCMS 1.0. Af…4.8
• CVE-2025-11070A vulnerability was identified in Projectworlds Online Shopp…9.8
• CVE-2025-11071A security vulnerability has been detected in SeaCMS 13.3.20…7.2
• CVE-2025-11072The MelAbu WP Download Counter Button WordPress plugin throu…5.3
• CVE-2025-11073A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0…4.7
• CVE-2025-11074A flaw has been found in code-projects Project Monitoring Sy…9.8
• CVE-2025-11075A vulnerability has been found in Campcodes Online Learning …9.8