135 matches found
WSO2 User Registration - Arbitrary Account Creation
The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...
refreshing-mcp-tool
Esto no está realmente terminado ni listo aún, pero quería dejar el código subido al repositorio. Esto básicamente implementa el protocolo de base de datos de F5, «mcp», que opera a través de un socket de dominio UNIX. Eso significa que necesitas un shell en el dispositivo F5 antes de poder usar...
CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
EUVD-2026-89085
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2026-90907: Authorization Bypass Through User-Controlled Key
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2025-64446-FortiWeb-CGI-Bypass-PoC
Herramienta de explotación CVE-2025-64446 Herramienta de explotación para la verificación y explotación de la vulnerabilidad CVE-2025-64446 en dispositivos FortiWeb. Descripción Esta herramienta prueba y explota una vulnerabilidad de path traversal CVE-2025-64446 en firewalls de aplicaciones web...
CVE-2021-38699
CVE-2021-38699 TastyIgniter 3.0.7 permite XSS a través del campo name durante la creación de cuentas de usuario. Existe una vulnerabilidad de Cross Site Scripting Almacenado en múltiples páginas de TastyIgniter v3.0.7 que permite la ejecución arbitraria de JavaScript...
CVE-2023-32749
PoC para CVE-2023-32749 Este es un PoC rápido y sucio que escribí para CVE-2023-32749 de Pydio Cells. Los scripts crean una nueva cuenta de usuario con todos los roles disponibles cuando se proporciona una credencial válida. Todo el crédito es para los investigadores originales. Instalación El...
CVE-2026-13171: Improper Access Control
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...
CVE-2026-3640 STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permissioncallback of returntrue, which allows all incoming requests...
PT-2026-29952
Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...
CVE-2009-4787
Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...
CVE-2020-36901: Cross-Site Request Forgery (CSRF)
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2025-57244: Improper Neutralization of Input During Web Page Generation
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2023-7325
CVE-2023-7325 affects Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10. The vulnerability is a server-side request forgery (SSRF) in the xmlrpc.sock handler that accepts crafted XML-RPC requests to reach internal unix socket RPC endpoints and execute privileg...
CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...
CVE-2025-56219: Improper Access Control
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhaustion and a Denial of Service DoS when an excessively large number of user accounts are created...