CVE-2025-52289

CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...

CVE-2026-12698

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...

CVE-2026-12698

The wpForo Forum WordPress plugin, in versions prior to 3.1.3 , is vulnerable to a mass assignment flaw. The plugin fails to restrict which profile fields a member can modify when editing their own account. This allows users with subscriber-level accounts to overwrite administrator-controlled fie...

PT-2026-67646

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...

FreeScout Security Bypass Vulnerability

FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability that can be exploited by an attacker to gain initial access to an account by leveraging an invitation li...

CVE-2025-48481

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invitehash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link fro...

CVE-2025-48481

Affected software: FreeScout (PHP/Laravel). Vulnerability: Business logic bypass allowing an attacker with an unactivated email invitation containing an invite_hash to self-activate a blocked or deleted account by using the invitation link, gaining initial access. Root cause / details: Described ...

CVE-2025-48481 FreeScout Has Business Logic Errors

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invitehash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link fro...

CVE-2025-48481: Improper Enforcement of Behavioral Workflow

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invitehash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link fro...

PT-2025-23247 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue allows an attacker with an unactivated email invitation containing the invite hash to self-activate their account, even if it is blocked or deleted. This is achieved by leveraging the...

CVE-2021-32620

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for hi...

CVE-2021-32620

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for hi...

CVE-2021-32620

XWiki Platform contains a vulnerability (CVE-2021-32620) where a user disabled on a wiki via email verification can re-activate themselves by following the activation link. Affected versions are prior to 11.10.13, 12.6.7, and 12.10.2; it has been fixed in 11.10.13, 12.6.7, 12.10.2, and 13.0. A ma...