CVE-2021-31646

—

CVSS 3.1

9.8 critical

EPSS

1%p70

Published

Apr 26, 2021 (Apr 26, 2021)

Modified

Jun 17, 2026

Description

Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP uniqueid function), allowing a brute force attack.

Vendors: gestsup
Products: gestsup
Weakness: CWE-307
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.