Total vulnerabilities in the database
In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username.
CVSS v3:
CWEs:
OWASP TOP 10: