EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface.
CVSS 4.0HIGH 8.6·Network·Low privileges·No interaction·EPSS 0.00511·Published 2026-02-24·Fixed in 6.0.1.20CWE-620