CVE-2023-0441

The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enab...

SUSE CVE-2015-5335

Cross-site request forgery CSRF vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub U...

VulnCheck KEV: CVE-2021-34621

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

WordPress plugin User Post Gallery 命令注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A command injection vulnerability...

CVE-2022-45758

SENS v1.0 is vulnerable to Cross Site Scripting XSS via com.liuyanzhao.sens.web.controller.admin, getRegister...

CVE-2022-0441

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin...

CVE-2022-0441

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin...

PT-2022-13186 · WordPress · Masterstudy Lms

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS WordPress plugin versions prior to 2.7.6 Description: The issue allows unauthenticated users to register as an admin due to the lack of validation for some parameters given when registering a new account. Recommendations: For...

VulnCheck KEV: CVE-2022-0441

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin...

CVE-2021-37394

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-37394

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

Design/Logic Flaw

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-34621

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34621

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

The user registration functionality of the plugin allowed arbitrary user meta to be supplied, including wpcapabilities, during registration which made it possible for users to register as an administrator. PoC 'Hax0r', 'regemail' = '[email protected]', 'regpassword' = 'password', 'regpasswordpresen...

PT-2019-19912 · WordPress · Wpgraphql

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. Recommendations: For WPGraphQL...

WordPress WPGraphQL Access Control Error Vulnerability (CNVD-2019-27673)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WPGraphQL is a plugin that provides an extensible GraphQL architecture and API for WordPress sites. An access control error vulnerabili...

cellphonerecon.com XSS vulnerability

Open Bug Bounty ID: OBB-629610 Description| Value ---|--- Affected Website:| cellphonerecon.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Moodle learning management system allows a hacker to replace a user during a session.

The vulnerability of the admin/registration/register.php function in the Moodle learning management system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to replace a user during a session by sending a request that sends statistics to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub U...