BIT-KEYCLOAK-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

CVE-2026-71504

Dolibarr versions prior to 24.0.0 contain an improper authorization flaw in the Members REST API . The API fails to verify password-change permissions, allowing an attacker who holds only member-creation rights to supply an arbitrary user identifier and new password in the request body, thereby r...

CVE-2026-16072

CVE-2026-16072 affects Keycloak’s organization management component. A delegated administrator with org-management permissions can create an invitation for a non-existent email address and then fetch the secret registration link via the API, enabling creation of new user accounts and their additi...

EUVD-2018-8288

Malware in sbrugna...

CVE-2020-8242

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

CVE-2020-8242

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

Sql injection

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

Packet Tide ExpressionEngine 安全漏洞

Packet Tide ExpressionEngine is an open source content management system CMS from Packet Tide USA. Packet Tide ExpressionEngine suffers from a SQL injection vulnerability that originates from unsanitized user input in ExpressionEngine = 5.4.0 Control Panel Member Creation, which can lead to SQL...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

Cross site request forgery (csrf)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

CVE-2018-16448 affects Cscms 4. It documents CSRF in admin endpoints: creating a member via upload/admin.php/user/save; authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid; and creating a super administrator and web editor via upload/admin.php/sys/sav...

Veris: [Stored XSS] sandbox.veris.in

Hello I want to report you another xss... but it's stored Steps to reproduce it : 1 . First create a group . 2. Go to https://sandbox.veris.in/portal/members/ and add a member with name " . 3. Add this member in a group created in step 1 .. . 4. Go to https://sandbox.veris.in/portal/assets/ and...