Full title: Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability 
Category: web applications
Platform: php
Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive password reset emails containing a malicious password reset link.

# 0day.today @ http://0day.today/