{"id":"GHSA-qj6h-m7xc-r2v3","aliases":["CVE-2016-5100"],"title":"Froxlor guessable password reset token","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","severity":"critical","score":9.8,"published":"2022-05-17T02:57:53.000Z","modified":"2024-04-25T21:43:27.390Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"froxlor/froxlor","sources":[{"name":"OSV · GHSA-qj6h-m7xc-r2v3","url":"https://osv.dev/vulnerability/GHSA-qj6h-m7xc-r2v3"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.9.35"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["0.9.35"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2016-5100","https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba","https://github.com/Froxlor/Froxlor"],"sources":[{"name":"OSV","id":"GHSA-qj6h-m7xc-r2v3","modified":"2024-04-25T21:43:27.390696Z","url":"https://osv.dev/vulnerability/GHSA-qj6h-m7xc-r2v3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:30:33.887Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}