CVE-2021-39409

CVE-2021-39409 在 Online Student Rate System v1.0 中，可以注册管理员账户，允许恶意行为者创建管理员账户并访问管理面板。 漏洞 root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip...

CVE-2026-90938 LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

CVE-2026-90938

LangBot (pip package langbot_plugin) through 0.4.17 exposes a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication depends on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose. Because docker-compos...

CVE-2024-8682

CVE-2024-8682 - JNews Unauthenticated Registration PoC JNews = 11.6.6 has a vulnerability that allows unauthenticated user registration via the ?ajax-request=jnews endpoint, even when WordPress registration is disabled. This works by first retrieving a valid jnewsnonce through the jnewsrefreshnon...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

CVE-2025-11986

1 Extract the public cryptoajax nonce from the restricted page root@kitploit: UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' NONCE=$curl -s "http://localhost/wordpress/" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

EUVD-2026-57725

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

EUVD-2026-56851

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the filename form field with no path containment check. Attackers can register an...

CVE-2026-72747

CVE-2026-72747 describes a stored cross-site scripting (XSS) in AVideo. An unauthenticated user can register and submit a phone value that is not sanitized, allowing JavaScript to be stored in the database. When an administrator visits the users management page, the unsanitized phone value is ren...

CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

PT-2026-70160

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-67611

OpenEMR up to version 8.2.0 is affected by an authentication bypass via the OAuth2 password grant flow exposed through an unauthenticated client registration endpoint. The vulnerability enables an attacker with valid credentials to register an OAuth2 client via the unauthenticated endpoint and th...

CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

EUVD-2026-52348

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-12251

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a...

EUVD-2026-51430

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a...

CVE-2026-65635

The CVE affects the boruta library (Elixir.Boruta.Openid) and its OpenID dynamic client registration path. The root cause is that Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlis...

CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...