18 matches found
CVE-2026-48085: Missing Authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
PT-2026-68747
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.1 Description An issue exists where a fully provisioned instance accepts unauthenticated POST requests to the /setup/create-admin-account endpoint. The system creates additional GLOBAL ADMIN accounts without...
EUVD-2026-21035
OpenPLCV3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access...
CVE-2021-47852 Rockstar Service - Insecure File Permissions
Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak permissions. Attackers can replace the RockstarService.exe with a malicious binary to create a new administrator user and gain elevated syste...
AnythingLLM 输入验证错误漏洞
AnythingLLM is a document chatbot that meets business requirements. An input validation error vulnerability exists in AnythingLLM that stems from improper input validation, where a user with the administrator role is able to craft a request containing a nested write operation to create a new...
CVE-2021-27859
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of...
Project Expense Monitoring System 1.0 Authentication Bypass Vulnerability
Exploit Title: Project expense Monitoring System | Create Admin Account Unauthorised Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14001/project-expense-monitoring-system-project-php-source-code-2020.html Software Link:...
Microsoft Windows Kernel Elevation of Privilege Vulnerability (CNVD-2020-43107)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in the Microsoft Windows Kernel, which aris...
CVE-2020-10625: Missing Authentication for Critical Function
WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...
PT-2020-12253
Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an unauthenticated remote user to create a new admin account. This can be exploited by sending a request to a vulnerable endpoint, potentially allowing attackers to...
CVE-2019-14702: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account...
PT-2019-13796
Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras with firmware through 6400.0.8.5 Description A CSRF issue was discovered in the HTTPD service, specifically affecting the "webparam?user&action=set¶m=add" API endpoint. This issue can be exploited to create an...
CVE-2019-9625: Cross-Site Request Forgery (CSRF)
JBMC DirectAdmin 1.55 allows CSRF via the /CMDACCOUNTADMIN URI to create a new admin account...
Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
Ticketly 1.0 - Cross-Site Request Forgery Add Admin Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery Add Admin Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-11-19 Google Dork: N/A Vendor: Abisoft https://abisoftgt.net Software Link:...
WordPress Theme Creative Multi-Purpose 9.1.3 - Persistent Cross-Site Scripting
Vendor Homepage: http://bridge.qodeinteractive.com/ Software Link: http://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054 Version: 9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Stored XSS, Ability to overwrite any theme settings. Time line: Found 23-Apr-2016, Vendor...
Microsoft Windows Graphics Memory Corruption Vulnerability (CNVD-2015-08114)
Microsoft Windows is a series of operating systems released by the American company Microsoft. A memory corruption vulnerability exists in the Windows font library of Microsoft Windows. The vulnerability exists because the program does not properly handle specially designed embedded fonts. A remo...
PT-2014-8947
Name of the Vulnerable Software and Affected Versions Snowfox CMS versions prior to 1.0.10 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the...
Zoom X4 / X5 SQL Injection / Authentication Bypass Vulnerabilities
Zoom X4 and X5 modems suffers from authentication bypass and remote SQL injection vulnerabilities. Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3...