CVE-2024-56178

An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the securityadminlocal role can create a new user in a group that has the admin role...

Exploit for Cross-Site Request Forgery (CSRF) in Eng Spagobi

CVE-2024-54792 Severity : Medium 6.1 CVSS sc...

UBUNTU-CVE-2024-13041

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. A...

PT-2025-6749 · Wazuh · Wazuh Siem

Name of the Vulnerable Software and Affected Versions: Wazuh SIEM version 4.8.2 Description: This issue is related to a broken access control vulnerability, allowing the unauthorized creation of internal users without assigning any existing user role. This could potentially lead to privilege...

PT-2025-1795 · Payu · Payu Commercepro Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: PayU CommercePro Plugin for WordPress versions up to, and including, 3.8.3 Description: The issue is due to the /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's...

ZenML < 0.55.5 Vulnerability - CVE-2024-2032

The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a race condition vulnerability which allows for the creation of multiple users with the same username when requests are sent in parallel. The vulnerability arises due to insufficient handling of...

Exploit for Cross-site Scripting in Melapress Wp_Activity_Log

CVE-2024-10793 PoC Set this lines to your hosts file:...

Admin Able to Create User Without Setting a Password

Description The application allows an admin to create a new user account without assigning a password. This could lead to security vulnerabilities, or the system might inadvertently create an account with a default or blank password, making it susceptible to unauthorized access. Proof of Concept ...

CVE-2024-45877

baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock...

Exploit for Cross-site Scripting in Salesagility Suitecrm

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Create User function. An attacker can inject malicious scripts by uploading specially crafted SVG files. This is only exploitable if the application does not properly sanitize user input specifically...

CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be exploited to...

CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be exploited to...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

EN GenTeamCityExploit is a PoC tool that targets a vulnera...

Exploit for Incorrect Implementation of Authentication Algorithm in Ivanti Virtual_Traffic_Management

CVE-2024-7593 Exploit Script This Bash script serves as a pro...

CVE-2024-9082

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9082

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9082 SourceCodester Online Eyewear Shop User Creation Users.php improper authorization

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9082

SourceCodester Online Eyewear Shop v1.0 has a documented vulnerability in the User Creation Handler (file path variants: /classes/Users.php?f=save or /Users.phpf=save). The root cause is improper authorization triggered by manipulating the type argument (value 1), which can be exploited remotely....

PT-2024-39416

Name of the Vulnerable Software and Affected Versions SourceCodester Online Eyewear Shop version 1.0 Description A critical issue affects some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the type argument with the input 1 leads to...