CVE-2026-22194 GestSup <= 3.2.60 CSRF Allows Privileged Actions

GestSup versions up to and including 3.2.60 contain a cross-site request forgery CSRF vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This...

CVE-2026-22194

GestSup versions up to and including 3.2.60 contain a cross-site request forgery CSRF vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This...

CVE-2023-31298

Cross Site Scripting XSS vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user...

CVE-2023-40918

KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Unauthorized users can create a new user with an admin role...

CVE-2018-12628

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...

CVE-2018-12457

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header...

CVE-2017-18421

cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...

CVE-2017-18177

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...

CVE-2020-12281

iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php...

CVE-2021-22538

A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server versions prior to 0.23.1, allows an attacker who 1 has UserWrite permissions and 2 is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their...

Phoenix Contact iDS6 DSSPro 安全漏洞

Phoenix Contact iDS6 DSSPro is a digital signage management system from iDS6 USA. A security vulnerability exists in Phoenix Contact iDS6 DSSPro version 6.2, which stems from the presence of an improper access control vulnerability that could lead to the creation of users, modification of roles a...

EUVD-2025-205808

An issue was discovered in Zeroheight SaaS prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification...

CVE-2025-65925

An issue was discovered in Zeroheight SaaS prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification...

CVE-2025-65925

An issue was discovered in Zeroheight SaaS prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification...

CVE-2025-65925

An issue was discovered in Zeroheight SaaS prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification...

PT-2025-54195

Name of the Vulnerable Software and Affected Versions Zeroheight versions prior to 2025-06-13 Description A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, th...

CVE-2025-65925

CVE-2025-65925 affects Zeroheight SaaS prior to 2025-06-13, where a legacy user-creation API path allowed accounts to be created without completing email verification. Unverified accounts could not access product functionality, but the bypassed verification controls enabled unintended account cre...

CVE-2019-25238

V-SOL GPON/EPON OLT Platform 2.03 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to create admin users, enable SSH, or modify system settings by tricking authenticated...

CVE-2019-25254

KYOCERA Net Admin 3.4.0906 is affected by a cross-site request forgery (CSRF) that allows an attacker to create administrative users without proper request validation. Public sources (Red Hat, CVE lists, PT-Security) describe that malicious pages can automatically submit requests when a logged-in...

CVE-2025-64400

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has edit on the enrollment-level user directory, but is missing a separate check that the enrollment...