CVE-2025-4889

CVE-2025-4889 affects code-projects Tourism Management System 1.0, specifically the AddUser function in the User Registration component. The vulnerability is a buffer overflow caused by manipulating the username and password arguments, requiring local access. The CVE notes that the exploit has be...

Code-Projects Tourism Management System 安全漏洞

Code-Projects Tourism Management System is an open source tourism management system from Code-Projects. A security vulnerability exists in Code-Projects Tourism Management System version 1.0, which is caused by a buffer overflow due to incorrect manipulation of the username/password parameters in...

PT-2025-21857 · Unknown · Code-Projects Courier Management System

Name of the Vulnerable Software and Affected Versions: code-projects Tourism Management System version 1.0 Description: A critical vulnerability has been found in the code-projects Tourism Management System. This issue affects the AddUser function of the User Registration component. The...

📄 WordPress User Registration and Membership Privilege Escalation

WordPress User Registration and Membership plugin versions prior to 4.1.2 remote privilege escalation exploit that executes a PHP payload. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WP Use...

CVE-2025-4474

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fedadminsettingformfunction function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the...

CVE-2025-3609

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3281 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the createstripesubscription function, due to missing validation on the 'memberid' use...

CVE-2025-3609

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3609

CVE-2025-3609: Reales WP STPT for WordPress allows unauthenticated user registration via the reales_user_signup_form AJAX action in all versions up to 2.1.2, due to a missing check on whether user registration is enabled. Root cause is the action not verifying the registration state before creati...

CVE-2025-3609 Reales WP STPT <= 2.1.2 - Unauthorized User Registration

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3609 Reales WP STPT <= 2.1.2 - Unauthorized User Registration

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

PT-2025-19823 · WordPress · Reales Wp Stpt

Name of the Vulnerable Software and Affected Versions: Reales WP STPT plugin for WordPress versions up to and including 2.1.2 Description: The issue allows unauthorized user registration due to the 'reales user signup form' AJAX action not checking if user registration is enabled before registeri...

PT-2025-19903

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions prior to 4.2.2 Description The issue is related to an Insecure Direct Object Reference in the create stripe subscription...

CVE-2025-4179

The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors...

CVE-2025-4179

The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors...

CVE-2025-4179 Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation

The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors...

CVE-2025-4179 Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation

The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...

CVE-2025-45949

A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...