OneOrZero Helpdesk v1.6.0 – v1.6.4 has an insecure password reset function that allows anyone to guess what the password is set to provided they know what the time of the server is. POC included.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/51279/OneOrZero-adv.txt
Source: https://packetstormsecurity.com/files/51279/OneOrZero-adv.txt.html