https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T02:24:46.164649+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124015 CVE-2026-124015 — Dixell/Copeland XWEB EVO Authentication Bypass via users.lua 2026-11-15T02:24:46.165395+00:00

Affected: Copeland XWEB EVO

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.