CVE-2026-2848 SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection

A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be...

CVE-2026-2848 SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection

A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be...

CVE-2025-13851

The Buyent Classified plugin for WordPress bundled with Buyent theme is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This...

CVE-2025-13563

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizzalmsproregisteruserfrontend' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to...

SourceCodester Simple Responsive Tourism Website SQL注入漏洞

SourceCodester Simple Responsive Tourism Website is an open-source tourism website developed by SourceCodester. Version 1.0 of SourceCodester Simple Responsive Tourism Website has a SQL injection vulnerability. This vulnerability stems from incorrect handling of the parameter Username in the...

PT-2026-21274

SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow index.php submitting to admin/user action.php. User-supplied fields such as Firstname, lastname, and email are stored in the backend database without adequate output encoding and...

Nsasoft SpotAuditor 安全漏洞

Nsasoft SpotAuditor is a advanced password recovery software developed by the US company Nsasoft. It is designed to restore passwords that have been lost or forgotten from over 40 popular Windows programs and tools. Nsasoft SpotAuditor 5.3.1.0 version contains a security vulnerability caused by...

SVXportal 安全漏洞

SVXportal is a portal website developed by Peter as an individual developer. Versions of SVXportal 2.5 and earlier had security vulnerabilities. These vulnerabilities stemmed from insufficient encoding of user input fields during the registration process, which could lead to stored-xss attacks...

PT-2026-21246

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Responsive Tourism Website version 1.0 Description A flaw exists in SourceCodester Simple Responsive Tourism Website that allows for SQL injection. This issue is related to the manipulation of the Username argument within...

PT-2026-21311

Name of the Vulnerable Software and Affected Versions SpotAuditor version 5.3.1.0 Description The application is susceptible to a denial of service condition. Unauthenticated attackers can cause the application to crash by providing an excessive amount of data—5000 bytes or more—in the registrati...

CVE-2025-14444

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'processpaypalsdkpayment' function in all versions up to, and including, 6.0.6.9. This is...

WordPress Buyent Theme (with Buyent Classified Plugin) plugin <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration vulnerability

Unauthenticated Privilege Escalation via User Registration vulnerability discovered by シルAsuna in WordPress Theme Buyent versions = 1.0.7...

CVE-2025-13851

The Buyent Classified plugin for WordPress bundled with Buyent theme is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This...

CVE-2025-13851 Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration

The Buyent Classified plugin for WordPress bundled with Buyent theme is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This...

CVE-2025-13851 Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration

The Buyent Classified plugin for WordPress bundled with Buyent theme is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This...

CVE-2025-13851

CVE-2025-13851 concerns Buyent Theme with Buyent Classified Plugin (

CVE-2025-13563

CVE-2025-13563 affects the Lizza LMS Pro plugin for WordPress, vulnerable in all versions up to 1.0.3 due to improper restriction in lizza_lms_pro_register_user_front_end, allowing unauthenticated attackers to supply the administrator role during registration and gain admin access. No remediation...

CVE-2025-13563 Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizzalmsproregisteruserfrontend' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to...

CVE-2026-0912

CVE-2026-0912 concerns the WordPress plugin Toret Manager (versions up to 1.2.7). Wordfence notes an authenticated (Subscriber+) Arbitrary Options Update vulnerability via AJAX actions due to missing capability checks in trman_save_option and trman_save_option_items, enabling an attacker to updat...

PT-2026-20600

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza lms pro register user front end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated...