CVE-2026-14949: Incorrect Authorization

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

PT-2019-14782

Name of the Vulnerable Software and Affected Versions kkcms version 1.3 Description The issue allows an attacker to add a user account via "admin/cms user add.php" due to a CSRF flaw. Recommendations For version 1.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized...

PT-2018-13674

Name of the Vulnerable Software and Affected Versions rejucms version 2.1 Description The issue allows for XSS via the u name parameter in the "ucenter/cms user add.php" API endpoint. Recommendations For rejucms version 2.1, avoid using the u name parameter in the "ucenter/cms user add.php"...

PT-2014-3217

Name of the Vulnerable Software and Affected Versions Seagate BlackArmor NAS 220 version sg2000-2000.1331 Description The issue affects the Seagate BlackArmor NAS 220 devices, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-sit...

PT-2012-2052

Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! versions prior to 3.65 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for...