Common Weakness Enumeration

CWE-521 Weak Password Requirements

Description

The product does not require that users should have strong passwords.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-521 ordered by modification date.

25 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-xq8g-hgh6-87hv	CVE-2026-35623	MODERATE	npm/openclaw	OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing	2026-04-18
GHSA-vcx4-4qxg-mfp4	CVE-2026-35628	MODERATE	npm/openclaw	OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret	2026-04-18
GHSA-mf5g-6r6f-ghhm	CVE-2026-35646	MODERATE	npm/openclaw	OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token	2026-04-10
GHSA-xmpv-j7p2-j873	CVE-2026-34203	LOW	pypi/nautobot	Nautobot: Management of users via REST API does not apply configured password validators	2026-03-31
GHSA-3ccg-x393-96v8	CVE-2026-27575	CRITICAL	golang/code.vikunja.io/api	Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change	2026-02-27
GHSA-5mrf-j8v6-f45g	CVE-2025-65014	LOW	-	LibreNMS has Weak Password Policy	2025-11-19
GHSA-6xj8-rrqx-r4cv	CVE-2025-11200	HIGH	pypi/mlflow	MLflow Weak Password Requirements Authentication Bypass Vulnerability	2025-11-05
GHSA-xgr2-5837-hf48	CVE-2025-11322	LOW	-	NovoSGA: Manipulation of User Creation Page can lead to weak password requirements	2025-10-07
GHSA-cm2r-rg7r-p7gg	CVE-2025-52997	MODERATE	golang/github.com/filebrowser/filebrowser golang/github.com/filebrowser/filebrowser/v2	File Browser vulnerable to insecure password handling	2025-08-04
GHSA-mg83-c7gq-rv5c	CVE-2025-22228	HIGH	maven/org.springframework.security/spring-security-crypto	Spring Security Does Not Enforce Password Length	2025-04-26
GHSA-4rj2-9gcx-5qhx	CVE-2025-1474	LOW	pypi/mlflow	MLflow has Weak Password Requirements	2025-04-09
GHSA-7wr6-fj4x-893v	CVE-2022-3376	MODERATE	pypi/rdiffweb	rdiffweb allows a new password to be the same as the previous password	2024-11-22
GHSA-8wxf-c45w-g66g	CVE-2022-3326	MODERATE	pypi/rdiffweb	rdiffweb vulnerable to password complexity bypass leading to weak passwords	2024-10-26
GHSA-mp5p-g2jv-r8qw	CVE-2022-3179	HIGH	pypi/rdiffweb	rdiffweb contains Weak Password Requirements	2024-10-25
GHSA-cw58-gpgw-hwx2	CVE-2020-7940	HIGH	pypi/Plone	Plone allows weak passwords	2024-10-14
GHSA-9gxx-32p7-ff7m	CVE-2023-2160	MODERATE	pypi/modoboa	Modoboa has Weak Password Requirements	2024-09-30
GHSA-h6jq-w432-j26w	CVE-2024-42850	LOW	maven/org.silverpeas.core/silverpeas-core	Silverpeas vulnerable to password complexity rule bypass	2024-08-19
GHSA-j63x-f657-2m9g	CVE-2023-4125	HIGH	golang/github.com/answerdev/answer	Answer has Weak Password Requirements	2023-08-03
GHSA-w3wr-gmwf-r333	CVE-2023-31098	CRITICAL	maven/org.apache.inlong/manager-pojo	Apache InLong has Weak Password Requirements in Apache InLong	2023-07-06
GHSA-mhmp-m6g7-7c24	CVE-2023-2106	HIGH	pypi/calibreweb	Weak Password Requirements in calibreweb	2023-04-26
GHSA-4p4m-5qp7-479x	CVE-2023-1753	MODERATE	-	phpMyFAQ has weak password requirements	2023-04-07
GHSA-fxrq-xhj9-rf5j	CVE-2023-0793	HIGH	-	Weak Password Requirements in thorsten/phpmyfaq	2023-02-24
GHSA-g7gf-2rqw-5rwx	CVE-2023-0569	MODERATE	gem/publify_core	Publify contains Weak Password Requirements	2023-02-07
GHSA-pm72-27mg-fc28	CVE-2023-0564	HIGH	-	Froxlor contains Weak Password Requirements	2023-02-06
GHSA-4p88-cfhq-f3vg	CVE-2023-0307	MODERATE	-	phpMyFAQ has Weak Password Requirements	2023-01-23