CVE-2025-41036

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAdmindescription', 'dataAdminfname' and 'dataAdminlname' parameters in /apprain/admin/account/edit...

CVE-2025-41036

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAdmindescription', 'dataAdminfname' and 'dataAdminlname' parameters in /apprain/admin/account/edit...

CVE-2025-41036

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAdmindescription', 'dataAdminfname' and 'dataAdminlname' parameters in /apprain/admin/account/edit...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAdmindescription, dataAdminfname, and dataAdminlname parameters in the /apprain/admin/account/edit process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...

CVE-2025-41036

CVE-2025-41036 describes a stored authenticated XSS in appRain CMF v4.0.5 caused by insufficient validation of input in the admin account edit path. Specifically, the vulnerable parameters are data[Admin][description], data[Admin][f_name], and data[Admin][l_name] submitted to /apprain/admin/accou...

CVE-2025-41036 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAdmindescription', 'dataAdminfname' and 'dataAdminlname' parameters in /apprain/admin/account/edit...

CVE-2025-41036 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAdmindescription', 'dataAdminfname' and 'dataAdminlname' parameters in /apprain/admin/account/edit...

PT-2025-35907

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAdmindescription, dataAdminf name, and...

appRain CMF 跨站脚本漏洞

appRain CMF is a content management framework from appRain Canada. The appRain CMF suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input on the /appain/admin/account/edit endpoint. An attacker could use the vulnerability to steal the victim...

PT-2025-34140 · Codeastro · Codeastro Ecommerce Site

Name of the Vulnerable Software and Affected Versions: CodeAstro Ecommerce Website version 1.0 Description: A vulnerability exists in CodeAstro Ecommerce Website 1.0 that allows for cross-site scripting. The issue is located in an unknown function of the /customer/my account.php?edit account file...

PT-2025-4117 · Zenvia · Zenvia Movidesk

Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of t...

PT-2024-16582 · Unknown · Romadebrian Web-Sekolah

Name of the Vulnerable Software and Affected Versions: romadebrian WEB-Sekolah version 1.0 Description: A vulnerability has been found in the file /Admin/akun edit.php of the component Backend. The manipulation of the argument kode leads to cross site scripting. It is possible to launch the attac...

CVE-2024-8490

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'saveaccountdetails' function. This makes it possible for unauthenticated attackers to edit the name, email...

CVE-2023-4845

A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file accounteditquery.php. The manipulation of the argument adminid leads to sql injection. The attack can be initiated remotely. The exploit...

Sql injection

A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file accounteditquery.php. The manipulation of the argument adminid leads to sql injection. The attack can be initiated remotely. The exploit...

PT-2023-30854 · Sourcecodester · Sourcecodester Simple Membership System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Membership System version 1.0 Description: A critical vulnerability was found in the SourceCodester Simple Membership System. The issue affects the file account edit query.php, where the manipulation of the admin id...

Simple Membership System SQL Injection Vulnerability

Simple Membership System is a simple membership system for Razormist individual developers. A SQL injection vulnerability exists in SourceCodester Simple Membership System version 1.0, which stems from an unknown section of the file accounteditquery.php, which leads to sql injection via the...

Class Scheduling System Security Vulnerability

Class Scheduling System is a class scheduling system by jkev individual developers. A security vulnerability exists in PHPJabbers Class Scheduling System version 1.0, which stems from a lack of password encryption when editing a user account updating a user's page, which allows an attacker to...

SUSE CVE-2013-1871

Cross-site scripting XSS vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network RHN Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter...

CVE-2018-20648

PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery CSRF via accountedit.php...