Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE vtenext: 25.02 Unverified Password Change via hub/rpwd.php (CVE-2025-71457) The vtenext 25.02 software can be attacked remotely, without logging in, through its hub/rpwd.php password recovery page. Patch → 25.02.1 https://cve.now/CVE-2025-71457?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🚨 CVE-2025-71457 (9.8) 🚨 vtenext, the open-source CRM, lets anyone who knows a user name change that account's password and log in as an administrator. vtenext 25.02 up to (but not including) 25.02.1 is affected. Upgrade to 25.02.1. https://t.co/6LuXKG876W
🔴 vtenext: vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php (CVE-2025-71457) Fix → 25.02.1 https://agentprime.io/advisories/CVE-2025-71457/