CVE-2026-77013: Missing Authorization

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-40471

CVE-2026-40471 affects the Hackage hackage-server where CSRF protection was lacking across endpoints. This could allow forged requests from scripts on foreign sites to abuse latent credentials, potentially uploading packages or performing administrative actions, with some unauthenticated actions ...

CVE-2026-40471: Cross-Site Request Forgery (CSRF)

hackage-server lacked Cross-Site Request Forgery CSRF protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abus...

PT-2026-30927

Hackage CSRF vulnerability Vulnerable File: src/Distribution/Server/Features/Votes.hs example Impact: can forge requests through XSS hackage-server lacked Cross-Site Request Forgery CSRF protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly...

CVE-2017-8930

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

CVE-2025-27583: Missing Authorization

Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...

PT-2024-38902

Name of the Vulnerable Software and Affected Versions: MStore API plugin for WordPress versions up to, and including, 4.15.3 Description: The issue arises from the plugin not checking if user registration is enabled before creating a user account through the register function. This allows...

CVE-2022-43340: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in dzzoffice 2.02.1SCUTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users...

CVE-2022-31294

An issue in the saveusers function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts...

Windows Media Foundation Privilege Escalation

The vulnerability of the Windows Media Foundation component in the Windows operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain privileges to install programs, view, modify, or delete data, and create...

CVE-2020-5863: Undefined Security Weakness

In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system...

CVE-2020-3148

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

CVE-2019-18380: Improper Authentication

Symantec Industrial Control System Protection ICSP, versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2016-8870

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting...

PT-2016-7601

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.4 Description The issue concerns the register method in the UsersModelRegistration class, which fails to check the Allow User Registration configuration setting when registration has been disabled. This allows...

Cisco Unified Intelligence Center Security Mechanism Bypass Vulnerability

Cisco Unified Intelligence Center is the management center for Cisco's Unified Communications system. A security mechanism bypass vulnerability exists in Cisco Unified Intelligence Center that could be exploited by a remote attacker to create user accounts by submitting a special request...

PT-2016-6900

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center CUIC versions 8.5.4 through 9.11 Unified Contact Center Express versions 10.01 through 11.01 Description The issue allows remote attackers to create user accounts by visiting an unspecified web page. This is...

PT-2016-6174

Name of the Vulnerable Software and Affected Versions Vtiger CRM versions 6.4.0 and earlier Description The issue concerns the modules/Users/actions/Save.php file in Vtiger CRM, which does not properly restrict user-save actions. This allows remote authenticated users to create or modify user...

Cisco Spark REST Interface Access Bypass Vulnerability

Cisco Spark is a collaboration services solution. A security vulnerability in the REST interface of Cisco Spark allows remote attackers to bypass established access restrictions by sending web requests to create arbitrary user accounts...