CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2026-74035

Wazuh versions 4.6.0 before 4.14.8 are vulnerable to an authentication bypass in the security.update_user component. The root cause is the placement of the reserved user guard and password policy inside a falsy truthiness check . This flaw allows a delegated user administrator to submit an empty ...

CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2026-109312

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

CVE-2026-109312

The Grav Login plugin (versions 2.7.0 before 3.9.9 ) contains an authentication bypass in the processUserProfile() function. The vulnerability stems from the software checking for an existing session user without verifying if a pending front-end 2FA session is fully authorized. An attacker posses...

CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

CVE-2026-109312: Improper Authentication

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile, which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invok...

CVE-2026-65603

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-65603: Improper Privilege Management

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-5523: Authorization Bypass Through User-Controlled Key

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the updateuser function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific...

CVE-2026-6584

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function updateuser of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument userid results in authorization bypass. The attack may be...

CVE-2026-7103

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file updateuser.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's...

EUVD-2026-23721

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function updateuser of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument userid results in authorization bypass. The attack may be...

SuperAGI security vulnerabilities

SuperAGI is an open-source infrastructure application developed by SuperAGI. It is used to build components, tools, frameworks, and models to achieve open-source AGI. Versions of SuperAGI 0.0.14 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling of the...

CVE-2025-70152

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/saveuser.php and /admin/updateuser.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters firstname, lastname,...

Student File Management System update_user.php File Cross-Site Scripting Vulnerability

Student File Management System is a student file management system. A cross-site scripting vulnerability exists in Student File Management System, which originates from an incorrect operation of the file /admin/updateuser.php, for which no detailed vulnerability details are currently available...

CVE-2025-14662 code-projects Student File Management System Update User update_user.php cross site scripting

A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/updateuser.php of the component Update User Page. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made...

CVE-2025-14621

A vulnerability was identified in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/updateuser.php. The manipulation of the argument userid leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and...