CVE-2025-12866: Hundred Plus Eip Plus

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.

Affected products

Published 2025-11-10. Last modified 2026-06-17.