CVE-2024-46375

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup function of the file rental/adminclass.php...

CVE-2024-46375

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup function of the file rental/adminclass.php...

SourceCodester Best House Rental Management System 安全漏洞

SourceCodester Best House Rental Management System is a house rental management system from SourceCodester, Inc. A security vulnerability exists in SourceCodester Best House Rental Management System version 1.0, which originates from an arbitrary file upload vulnerability in the signup function o...

PT-2024-31976 · Unknown · Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: Best House Rental Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the signup function of the file rental/admin class.php. This could potentially lead to system compromise. There is no...

CVE-2024-46375: Improper Limitation of a Pathname to a Restricted Directory

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup function of the file rental/adminclass.php...

CVE-2024-46375

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup function of the file rental/adminclass.php...

Insightly: Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"

The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of...

GHSA-64F8-PJGR-9WMR Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

PT-2026-60942

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.5.5 SurrealDB versions 2.0.0-beta through 2.0.0-beta.2 Description The RPC API accepts arbitrary objects in the signin and signup operations without recursively validating them for non-computed values. When a reco...

PYSEC-2024-90

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the...

WordPress Viral Signup plugin <= 2.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Project Black in WordPress Plugin Viral Signup versions = 2.1...

CVE-2024-6926

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6926

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6926

CVE-2024-6926 affects the Viral Signup WordPress plugin (versions up to and including 2.1). The issue is an SQL injection caused by insufficient escaping/sanitisation of a user-supplied parameter used in a SQL query via an unauthenticated AJAX action. The vulnerability is documented as affecting ...

CVE-2024-6926 Viral Signup <= 2.1 - Unauthenticated SQLi

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

WordPress plugin Viral Signup 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-6926: Improper Neutralization of Special Elements used in an SQL Command

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

WordPress Viral Signup Plugin <= 2.1 is vulnerable to SQL Injection

Software Viral Signup Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6926 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID bccf241bb1d7 Credits Project Black Required privilege Unauthenticated...

PT-2024-37964 · WordPress · Viral Signup

Name of the Vulnerable Software and Affected Versions: Viral Signup WordPress plugin versions 2.1 and earlier Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated user...