Cwe-640 — PoC Archivehttps://poc.intelseclab.com/tags/cwe-640/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000FlowiseAI Account-Takeover via Forgot-Password Token Leak (CVE-2025-58434)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-58434-flowise-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-58434-flowise-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-58434. Status: Weaponized. Affects: FlowiseAI (/api/v1/account/forgot-password and /api/v1/account/reset-password endpoints). Tags: flowiseai, auth-bypass, account-takeover, forgot-password, reset-password, api, python, cwe-640.webCriticalflowiseaiauth-bypassaccount-takeoverforgot-passwordreset-passwordapipythoncwe-640ARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Critical severity (CVSS 9.8) — web · CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074). Status: PoC. Affects: ARMember – Membership Plugin & Content Restriction (WordPress plugin). Tags: wordpress, armember, membership-plugin, sql-injection, password-reset, plaintext-key, account-takeover, cwe-640.webCriticalwordpressarmembermembership-pluginsql-injectionpassword-resetplaintext-keyaccount-takeovercwe-640