Information Exposure

microweber/microweber, is vulnerable to information exposure. The vulnerability exists in User.php, allowing an attacker to read sensitive information in the system...

Privilege Escalation

thorsten/phpmyfaq is vulnerable to Privilege Escalation. The vulnerability exists because of the insufficient permission checks in the user.php, which allows an attacker to gain escalated privilege through the isSuperAdmin feature...

CVE-2023-26817

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution RCE vulnerability via the component /controllers/api/user.php...

CVE-2023-26817

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution RCE vulnerability via the component /controllers/api/user.php...

CVE-2023-26817

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution RCE vulnerability via the component /controllers/api/user.php...

CVE-2023-26817: Improper Control of Generation of Code

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution RCE vulnerability via the component /controllers/api/user.php...

CVE-2023-26817

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution RCE vulnerability via the component /controllers/api/user.php...

CVE-2023-26817

CVE-2023-26817 concerns CodeFever before 2023.2.7-commit-b1c2e7f, with a remote code execution flaw in the component /controllers/api/user.php. Multiple connected sources corroborate the RCE in this version range and cite a high impact (CVSS 3.1: 8.8, HIGH) with NETWORK attack vector and LOW priv...

Improper Access Control

moodle/moodle is vulnerable to Improper Access Control. The vulnerability exists in the fillpreferencescache function of user.php due to insufficient limitations on the "start page" preference which allows a remote attacker to gain unauthorized access to the restricted functionalities of the...

CVE-2022-4155: Undefined Security Weakness

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wpuserid GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges i.e. on multisite...

CVE-2022-4154: Undefined Security Weakness

The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wpuserid GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges i.e. on multisite WordPress configurations to leak sensitive...

Insecure Random Number Generator

phpservermon/phpservermon uses an insecure random number generator. The vulnerability exists in the generatePasswordResetToken function of User.php because of the insecure mtrand random number generator function which allows an attacker to guess the reset password hashes...

Insecure Random Number Generator

phpservermon/phpservermon uses an insecure random number generator. The vulnerability exists because of the insecure mtrand random number generator function in the loginWithCookieData function of User.php, allowing an attacker to guess the strings it generates...

PHPServerMon PRNG has Insufficient Entropy

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4241

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4241 phpservermon User.php setUserLoggedIn predictable algorithm in random number generator

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

CVE-2021-4240 phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the publ...

PT-2022-10699 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 1.2 Description: The issue is related to SQL Injection via the SEMCMS User.php file. Recommendations: For SEMCMS version 1.2, update to a version that fixes the SQL Injection issue in SEMCMS User.php...

PT-2022-18574

Name of the Vulnerable Software and Affected Versions SourceCodester Gym Management System affected versions not specified Description A problematic vulnerability has been found in the SourceCodester Gym Management System. The issue affects an unknown function of the file delete user.php. The...

PT-2022-21297

Name of the Vulnerable Software and Affected Versions Prison Management System version 1.0 Description The issue is related to a SQL injection vulnerability. It occurs via the id parameter at the "/pms/admin/user/manage user.php" endpoint. Recommendations For Prison Management System version 1.0,...