CVE-2024-50475

CVE-2024-50475 Signup Page = 1.0 - Unauthenticated Arbitrary Options Update Description: The Signup Page plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in all versions up to, and including, 1.0. This...

Viral Signup <= 2.1 - SQL Injection

The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2026-111708

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

EUVD-2026-103000

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-111708

The WhaTicket Community software (specifically through commit cf04795 ) contains an authentication bypass vulnerability in the POST /auth/signup endpoint. An unauthenticated attacker can gain administrator privileges by either omitting the profile field or explicitly setting it to admin during se...

Azure-APIM-Dev-Portal-Signup-Bypass

A proof-of-concept script for bypassing a disabled developer portal signup on Azure API Management APIM by directly invoking the backend registration API. What it does Azure APIM developer portals can be configured to disable self-service signup through the portal UI. In some deployments the...

PT-2026-116107

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2024-55963

CVE‑2024‑55963 Appsmith RCE PoC PoC exploit for CVE‑2024‑55963 that runs arbitrary commands or spawns reverse shell on vulnerable Appsmith instances. It automatically handles both modern servers with the environmentId feature and much older “legacy” builds that pre‑date it, so you can use one...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM Cross-Tenant Signup Bypass Status 01.12.2025: This vulnerability is still live and exploitable. Microsoft has not patched this issue and considers it "by design." Security Advisory GHSA-vcwf-73jp-r7mv CVE-2025-66390 Summary A security vulnerability in Azure API Management APIM Develope...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover via Weak Password Reset Validation via 'resetuserid' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'resetactivationcode' Leading to Account Takeover CVE-2026-12417 & CVE-2026-12416 — Mass...

CVE-2026-69226

A security flaw in Portal for ArcGIS allows unauthenticated users to create new accounts via the sharing endpoint. The vulnerability occurs because the application fails to enforce restrictions even when self-service account registration is disabled (disableSignup=true ). An attacker can bypass t...

Confluence Server - Remote Code Execution

Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version...

CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget Plugin 🔥 Base Score: 9.1 CRITICAL CWE ID: CWE-94 – Improper Control of Generation of Code 'Code Injection' 🧠 Description The plugin allows administrators to modify the contents of sn.php via the Sender’s Name field in the settings page. User-supplied inp...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

Astra Linux – Vulnerability found in Python 3.11, Python 2.7, Python 3.7, and Pypy

The email module in Python, as of version 3.11.3, incorrectly parses email addresses that contain special characters. The incorrect portion of the RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism by allowing access to...

EUVD-2026-92146

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes...

CVE-2026-105170

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes...

CVE-2026-105170: Missing Authentication for Critical Function

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes...