EUVD-2026-62485

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...

CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...

CVE-2026-45274

MyBooks (also known as Talebook), an ebook management web server, is affected by an unauthenticated registration bypass in versions 3.41.2 and earlier . The SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py fails to enforce the ALLOW_REGISTER configuration flag on the s...

CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 contain a registration bypass vulnerability. The API endpoints POST /api/register and POST /api/v3.1/register do not validate the security.enableRegistration configuration flag, which is only enforced by the HTML registration page. An authenticated attacker can exp...

CVE-2026-76209 phpMyFAQ before v4.1.6 Registration Bypass via API

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST...

CVE-2026-76209 phpMyFAQ before v4.1.6 Registration Bypass via API

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST...

EUVD-2026-62238

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

PT-2026-78391

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Failure to validate the security.enableRegistration setting in API endpoints allows the creation of user accounts even when registration is disabled. This bypasses the restriction enforced on the HT...

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

PT-2026-76943

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...

CVE-2026-13610

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

CVE-2026-73284 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57074

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...