1542 matches found
CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
WordPress plugin WP User Profile Avatar security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...
CVE-2024-0185
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
CVE-2024-0185
CVE-2024-0185 concerns RRJ Nueva Ecija Engineer Online Portal v1.0. The vulnerability affects the Avatar Handler’s dasboard_teacher.php, where manipulation enables unrestricted file uploads. Exploitation is described as remote and publicly disclosed. Affected product is RRJ Nueva Ecija Engineer O...
CVE-2024-0185 RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
CVE-2024-0185 RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
PT-2024-15369 · Unknown · Rrj Nueva Ecija Engineer Online Portal
Name of the Vulnerable Software and Affected Versions: RRJ Nueva Ecija Engineer Online Portal version 1.0 Description: A critical issue affects the processing of the file dasboard teacher.php of the component Avatar Handler, leading to unrestricted upload. The attack may be initiated remotely...
WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar PoC POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...
PT-2023-32914 · Unknown · Gopeak Masterlab
Name of the Vulnerable Software and Affected Versions: gopeak MasterLab versions up to 3.3.10 Description: A critical issue has been found in the function add/update of the file app/ctrl/admin/User.php, where the manipulation of the avatar argument leads to unrestricted upload. This issue can be...
WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...
WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software WP User Profile Avatar Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52118 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ce43b2baade Credits Khalid Yusuf Required privilege...
Liberapay: Avatar URL is exposed in patron export for secret donations
The avatar URL was exposed in the patron export for secret donations, which could potentially identify donors who wished to remain anonymous...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
DoraCMS 安全漏洞
DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...
CVE-2023-5884
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link...
CVE-2023-5884 Word Balloon < 4.20.3 - Avatar Removal via CSRF
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link...
WordPress plugin Word Balloon security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in the WordPress...
PT-2023-32393 · WordPress · Word Balloon
Name of the Vulnerable Software and Affected Versions: Word Balloon WordPress plugin versions prior to 4.20.3 Description: The issue allows an unauthenticated attacker to trick a logged-in user into deleting arbitrary avatars by clicking a link, due to a lack of protection against CSRF attacks in...
