CVE-2025-15398

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-640

• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnqExploit, Third Party Advisory
• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq#-span--strong-step-1--trigger-password-reset-for-victim--strong---span-Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.339207Permissions Required, VDB Entry
• https://vuldb.com/?id.339207Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.720129Exploit, Third Party Advisory, VDB Entry
• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnqExploit, Third Party Advisory
• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq#-span--strong-step-1--trigger-password-reset-for-victim--strong---span-Exploit, Third Party Advisory

Published

Dec 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15391A weakness has been identified in D-Link DIR-806A 100CNb11. …9.8
• CVE-2025-15392A weakness has been identified in Kohana KodiCMS up to 13.82…8.8
• CVE-2025-15393A security vulnerability has been detected in Kohana KodiCMS…8.8
• CVE-2025-15394A vulnerability was detected in iCMS up to 8.0.0. Affected i…7.2
• CVE-2025-15395IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 th…5.4
• CVE-2025-15396The Library Viewer WordPress plugin before 3.2.0 does not sa…7.1
• CVE-2025-1540An issue has been discovered in GitLab CE/EE for Self-Manage…4.2
• CVE-2025-15400The OpenPix for WooCommerce WordPress plugin through 2.13.3 …6.5
• CVE-2025-15403The RegistrationMagic plugin for WordPress is vulnerable to …9.8
• CVE-2025-15404A security vulnerability has been detected in campcodes Scho…8.8
• CVE-2025-15405A vulnerability was detected in PHPEMS up to 11.0. The impac…8.8
• CVE-2025-15406A flaw has been found in PHPGurukul Online Course Registrati…8.8