CVE-2025-64047: Improper Neutralization of Input During Web Page Generation

OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting XSS in /user/user-move.php...

CVE-2024-2775: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiat...

PT-2021-22248

Name of the Vulnerable Software and Affected Versions Eigen NLP version 3.10.1 Description A lack of access control on the "/auth/v1/user/user-guid/" user edition endpoint could permit any logged-in user to increase their own permissions via a user permissions array in a PATCH request. A guest us...

PT-2018-14629

Name of the Vulnerable Software and Affected Versions K-iwi Framework version 1775 Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain endpoints. The vulnerable parameters are user group id in the "admin/user/group/update" endpoint and user id i...

PT-2018-14661

Name of the Vulnerable Software and Affected Versions School Attendance Monitoring System version 1.0 Description The issue is related to a CSRF vulnerability. It affects the "/user/user/edit.php" API endpoint. Recommendations For School Attendance Monitoring System version 1.0, consider...

CVE-2018-18755: Improper Neutralization of Special Elements used in an SQL Command

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update usergroupid parameter or the admin/user/user/update userid parameter...

CVE-2018-18797: Cross-Site Request Forgery (CSRF)

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

PT-2018-13798

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3 Description An issue was discovered in the portal component of Oracle WebCenter Interaction Portal, which is delivered with an insecure default User Profile community configuration. This...

PT-2014-2588

Name of the Vulnerable Software and Affected Versions SimpleHRM versions 2.3, 2.2, and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter to "index.php/user/setLogin". This is a SQL injection vulnerability in the login page,...

CVE-2010-2111: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in user/user-set.do in Pacific Timesheet 6.74 build 363 allows remote attackers to hijack the authentication of administrators for requests that create a new administrator via a newadmin action...

CVE-2010-1610: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an application administrator for requests that create an administrative account via a POST request with the route parameter set to "user/user/insert." NOTE: some of...