2121 matches found
WordPress plugin User Registration 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
CVE-2022-43097
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & login pages...
CVE-2022-43097
Phpgurukul User Registration & User Management System v3.0 is affected by multiple stored XSS vulnerabilities in the registration and login forms. The XSS can be triggered via the firstname and lastname parameters. Affected component is the user input handling for registration/login; root cause d...
CVE-2021-24649
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...
User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
The plugin does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example. PoC The following Python script automates the exploitation of this plugin by...
Privilege Escalation
github.com/grafana/grafana is vulnerable to privilege escalation due to improper email validation in the response parameter of orginvite.go. Admins can create new users with a registration link sent via email, allowing an attacker to register a user on the site with a different email address used...
CVE-2022-39306 Grafana contains Improper Input Validation
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non...
Design/Logic Flaw
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, th...
CVE-2022-39229 Grafana users with email as a username can block other users from signing in
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, th...
Online Examination System 1.0 SQL Injection
Exploit Title: Online Examination System - SQL Injection Google Dork: N/A Date: 2022-9-28 Exploit Author: yousef alraddadi - https://twitter.com/y0usef11 Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-examination/ Software Link:...
Food Ordering Management System 1.0 SQL Injection
Exploit Title: Food Ordering Management System - SQL Injection Google Dork: N/A Date: 2022-9-27 Exploit Author: yousef alraddadi - https://twitter.com/y0usef11 Vendor Homepage: https://www.sourcecodester.com/php/15689/food-ordering-management-system-php-and-mysql-free-source-code.html Software...
GHSA-H5J3-5X63-P8JV XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
Impact By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially givin...
XWiki 8.0 < 13.10.5, 14.0 < 14.3 User Registration Vulnerability (GHSA-h5j3-5x63-p8jv)
Xwiki is prone to a user registration vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...
CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...
CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2...
PT-2022-15896 · WordPress · Simple Membership
Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue allows a user to change their membership at the registration stage due to insufficient checking of a user-supplied parameter. Recommendations: For versions prio...
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel SQL Injection Vulnerability
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel is a user registration and login system with an administrative panel from EGavilan Media. EGavilan Media User-Registration -and-Login-System-With-Admin-Panel version 1.0 contains a SQL injection vulnerability, which stems from...
CVE-2021-44096
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profileaction - updateuser. This allows a remote attacker to compromise Application SQL database...
Sql injection
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profileaction - updateuser. This allows a remote attacker to compromise Application SQL database...
CVE-2021-44096
The CVE-2021-44096 entry concerns EGavilan Media User-Registration-and-Login-System-With-Admin-Panel version 1.0. It is vulnerable to SQL Injection via the profile_action - update_user endpoint, allowing a remote attacker to compromise the application’s SQL database. The connected documents consi...