CVE-2024-29868

CVE-2024-29868: Use of Cryptographically Weak PRNG in Recovery Token Generation This repository contains the proof of concept related to CVE-2024-29868 that affects Apache StreamPipes from v0.69.0 through 0.93.0. Description : Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2026-54907

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54907 Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54907

Caddy Proxy Manager , a web interface for managing Caddy Server reverse proxies and certificates, enabled email and password self-registration by default (at /api/auth/sign-up/email) prior to version 1.5.1 . This allowed an unauthenticated remote actor to create an active account with the user ro...

CVE-2026-54907 Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2025-5802

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2025-5802

CVE-2025-5802 is a username enumeration vulnerability in multiple WSO2 products , arising from the self-registration flow. When a user attempts to register with an already-existing username, the system returns an error message that explicitly indicates the username is in use, allowing an unauthen...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-77915

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2026-77915

rConfig versions 8.0.0 through before 8.2.13 contain a critical authentication bypass (CVSS 3.1: 9.8 ) caused by a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Because the registration controller does not assign a ...

PT-2026-80923

Name of the Vulnerable Software and Affected Versions rConfig versions 8.0.0 through 8.2.12 Description An authentication bypass exists due to a duplicate Auth::routes call in the routes/web.php file, which inadvertently re-enables the POST /register endpoint after it had been disabled. This allo...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

EUVD-2026-58650

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...