1369 matches found
BigAntSoft BigAnt Server 安全漏洞
BigAntSoft BigAnt Server is an instant messaging solution from BigAntSoft, Inc. A security vulnerability exists in BigAntSoft BigAnt Server version 5.6.06 and prior versions. An attacker can exploit this vulnerability to upload and execute arbitrary PHP code by creating an administrator user via...
Paessler PRTG Network Monitor Local File Inclusion Vulnerability
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges including administrator...
CVE-2024-57522
SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting XSS in Users.php. An attacker can inject a malicious script into the username or name field during user creation...
CVE-2024-57522
SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting XSS in Users.php. An attacker can inject a malicious script into the username or name field during user creation...
CVE-2024-56178
An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the securityadminlocal role can create a new user in a group that has the admin role...
Couchbase Server 安全漏洞
Couchbase Server is a distributed open source NoSQL non-relational database from Couchbase, Inc. in the United States. It supports data query, full-text search and active global replication. A security vulnerability exists in Couchbase Server versions 7.6.x through 7.6.3. An attacker could exploi...
Exploit for Cross-Site Request Forgery (CSRF) in Eng Spagobi
CVE-2024-54792 Severity : Medium 6.1 CVSS sc...
UBUNTU-CVE-2024-13041
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. A...
PT-2025-6749 · Wazuh · Wazuh Siem
Name of the Vulnerable Software and Affected Versions: Wazuh SIEM version 4.8.2 Description: This issue is related to a broken access control vulnerability, allowing the unauthorized creation of internal users without assigning any existing user role. This could potentially lead to privilege...
PT-2025-1795 · Payu · Payu Commercepro Plugin For Wordpress
Name of the Vulnerable Software and Affected Versions: PayU CommercePro Plugin for WordPress versions up to, and including, 3.8.3 Description: The issue is due to the /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's...
ZenML < 0.55.5 Vulnerability - CVE-2024-2032
The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a race condition vulnerability which allows for the creation of multiple users with the same username when requests are sent in parallel. The vulnerability arises due to insufficient handling of...
Exploit for Cross-site Scripting in Melapress Wp_Activity_Log
CVE-2024-10793 PoC Set this lines to your hosts file:...
Admin Able to Create User Without Setting a Password
Description The application allows an admin to create a new user account without assigning a password. This could lead to security vulnerabilities, or the system might inadvertently create an account with a default or blank password, making it susceptible to unauthorized access. Proof of Concept ...
CVE-2024-45877
baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock...
Exploit for Cross-site Scripting in Salesagility Suitecrm
CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Create User function. An attacker can inject malicious scripts by uploading specially crafted SVG files. This is only exploitable if the application does not properly sanitize user input specifically...
CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be exploited to...
CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be exploited to...