136 matches found
WSO2 User Registration - Arbitrary Account Creation
The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...
refreshing-mcp-tool
Это ещё не совсем готово, но я хотел закоммитить код. По сути, это реализация проприетарного протокола базы данных F5, «mcp», который работает через UNIX domain socket. Это означает, что вам нужен доступ к shell на устройстве F5, прежде чем вы сможете использовать любой из этих инструментов. Обыч...
CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
EUVD-2026-89085
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2026-90907: Authorization Bypass Through User-Controlled Key
Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...
CVE-2025-64446-FortiWeb-CGI-Bypass-PoC
Outil d'exploitation CVE-2025-64446 Outil d'exploitation pour la vérification et l'exploitation de la vulnérabilité CVE-2025-64446 dans les appareils FortiWeb. Description Cet outil teste et exploite une vulnérabilité de traversée de chemin CVE-2025-64446 dans les pare-feu d'applications web...
CVE-2021-38699
CVE-2021-38699 TastyIgniter 3.0.7 permet une XSS via le champ nom lors de la création d'un compte utilisateur. Une vulnérabilité de Cross Site Scripting stockée existe dans plusieurs pages de TastyIgniter v3.0.7 qui permet l'exécution arbitraire de JavaScript. https://vulners.com/cve/CVE-2021-386...
CVE-2023-32749
PoC для CVE-2023-32749 Это быстрый и черновой PoC, который я написал для CVE-2023-32749 в Pydio Cells. Скрипт создаёт новую учётную запись пользователя со всеми доступными ролями при наличии действительных учётных данных. Вся заслуга принадлежит оригинальным исследователям. Установка Единственное...
CVE-2026-13171: Improper Access Control
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...
CVE-2026-3640 STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permissioncallback of returntrue, which allows all incoming requests...
PT-2026-29952
Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...
CVE-2009-4787
Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...
CVE-2020-36901: Cross-Site Request Forgery (CSRF)
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2025-57244: Improper Neutralization of Input During Web Page Generation
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2023-7325
CVE-2023-7325 affects Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10. The vulnerability is a server-side request forgery (SSRF) in the xmlrpc.sock handler that accepts crafted XML-RPC requests to reach internal unix socket RPC endpoints and execute privileg...
CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...
CVE-2025-56219: Improper Access Control
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhaustion and a Denial of Service DoS when an excessively large number of user accounts are created...