Hundred Plus EIP Plus Weak Password Recovery Mechanism Vulnerability
Vulnerability
A vulnerability exists in EIP Plus developed by Hundred Plus, prior to version RELEASE_240626, due to a weak password recovery mechanism. This flaw allows unauthenticated remote attackers to predict or brute-force the 'forgot password' link, successfully resetting any user's password.
Impact
Exploitation of this vulnerability allows for unauthorized password resets, potentially leading to unauthorized account access.
Remediation
Users are advised to update to version RELEASE_240626 or later.
Added: Nov 10, 2025, 3:19 AM
Updated: Nov 10, 2025, 3:19 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
6.2remediation
7.7relevance
1.0threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.