Cpe:2.3:a:faveosuite:faveo_helpdesk_2_0_3:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afaveosuitefaveo_helpdesk_2_0_3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 20:17:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFaveo Helpdesk: Weak password recovery (CVE-2026-115973)https://feed.craftedsignal.io/briefs/2026-10-faveo-helpdesk-password-reset/Sat, 24 Oct 2026 20:17:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-faveo-helpdesk-password-reset/A vulnerability in Faveo Helpdesk 2.0.3 allows for remote manipulation of password recovery functions.A vulnerability (CVE-2026-115973) has been identified in Faveo Helpdesk 2.0.3. The issue involves the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset functions within app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation results in weak password recovery and can be initiated remotely. The vendor was contacted early about this disclosure.

]]>highadvisory