roller-csrf

Apache Roller v6.1.2 - 프로필 업데이트 기능의 사이트 간 요청 위조CSRF 취약점 세부 정보 버전 : v6.1.2 날짜 : 2025-11-09 익스플로잇 작성자 : Van Lam Nguyen 페이스북 : https://www.facebook.com/vanlam1412 공급업체 홈페이지 : https://roller.apache.org 소프트웨어 링크 : https://github.com/apache/roller/archive/refs/tags/roller-6.1.2.zip 테스트 환경 : Windows CVE...

WordPress ProfileGrid plugin <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Profile and Cover Image Modification vulnerability discovered by knani alaaeddine iwd in WordPress Plugin ProfileGrid versions = 5.9.7.2...

EUVD-2018-18402

Malware in sbrugna...

EUVD-2025-28233

Malicious code in bioql PyPI...

CVE-2025-26362

CVE-2025-26362 describes a CWE-306 issue in Q-Free MaxTime: the vulnerability exists in the maxprofile/setup/routes.lua function, affecting MaxTime versions 2.11.0 and earlier. An unauthenticated remote attacker can craft HTTP requests to set an arbitrary authentication profile on the server. Thi...

WordPress Ultimate Member plugin <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Profile Picture Update vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.8.9...

CVE-2023-52060

A Cross-Site Request Forgery CSRF in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request...

CVE-2022-1349 WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the imageid parameter of the ajax action wpqaremoveimage belongs to the requesting user, allowing any users with privileges as low as Subscriber to...

WordPress WPQA - Builder forms Addon plugin < 5.2 - Arbitrary Profile Picture Deletion via IDOR vulnerability

Arbitrary Profile Picture Deletion via IDOR vulnerability discovered by Binit Ghimire in WordPress WPQA - Builder forms Addon plugin versions 5.2. Solution Update the WordPress WPQA - Builder forms Addon plugin to the latest available version at least 5.2...

CVE-2021-25048: Improper Neutralization of Input During Web Page Generation

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them...

CVE-2018-6655

PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field...

CVE-2018-6655: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field...

Design/Logic Flaw

The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue...

CVE-2007-6497: Undefined Security Weakness

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...