CVE-2016-9479: b2evolution

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.

Affected products

• b2evolution b2evolution: up to and including 6.7.8

Published 2016-12-02. Last modified 2026-06-17.