33 matches found
CVE-2025-69933
CVE-2025-69933 concerns CodeAstro Membership Management System 1.0, described as vulnerable to SQL Injection in /memberProfile.php?id=1. The connected sources (NVD, CVE List, CVERecord, EUVD) reiterate this description. No further exploitation details, affected versions beyond 1.0, or remediation...
CVE-2026-15016
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...
CVE-2026-15016
CVE-2026-15016 affects the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions WordPress plugin. The vulnerability is a Stored Cross-Site Scripting issue in the Readonly User Field via the [pmpro_member_profile_edit] shortcode, exploitable in all versions up to and...
CVE-2026-15016 Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...
CVE-2026-15016
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...
CVE-2019-25442
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to memberprofile.asp with malicious PF values to extract sensitive database information...
CVE-2019-25442
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to memberprofile.asp with malicious PF values to extract sensitive database information...
CVE-2019-25442 Web Wiz Forums 12.01 SQL Injection via PF Parameter
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to memberprofile.asp with malicious PF values to extract sensitive database information...
CVE-2019-25442
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to memberprofile.asp with malicious PF values to extract sensitive database information...
CVE-2019-25442 Web Wiz Forums 12.01 SQL Injection via PF Parameter
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to memberprofile.asp with malicious PF values to extract sensitive database information...
PT-2026-21432
Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Attackers can send GET requests to member profile.asp with malicious PF values to extract sensitive database informatio...
PT-2025-33710 · WordPress · Real Spaces - Wordpress Properties Directory Theme
Name of the Vulnerable Software and Affected Versions: Real Spaces - WordPress Properties Directory Theme versions prior to 3.6 Description: The Real Spaces - WordPress Properties Directory Theme for WordPress is susceptible to privilege escalation through the change role member parameter during...
CVE-2024-10528
CVE-2024-10528 (Ultimate Member) affects WordPress plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership. The root cause is a missing capability check in the image resize handlers (wp_ajax_um_resize_image() and ajax_resize_image()), which a...
WordPress Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss Plugin <= 1.4.10 is vulnerable to Cross Site Scripting (XSS)
Software Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Cla...
Malicious code in ent-member-profile-home (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 512394559edad846b54131928ac811c25de69d520115a38e7a916722535305de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-306 Malicious code in ent-member-profile-home (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 512394559edad846b54131928ac811c25de69d520115a38e7a916722535305de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description In the repo online rental property manager where i found a stored xss which gets exploited on member profile view which is lead by group name. 🕵️♂️ Proof of Concept Video POC: https://drive.google.com/file/d/1oQUZmQfFwaiRUkGYVkJoXxedeSENDbwQ/view?usp=sharing Steps to reproduce: 1...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description In the repo online invoicing system i found a stored xss which gets exploited on member profile view which is lead by group name. 🕵️♂️ Proof of Concept Video POC: https://drive.google.com/file/d/1wUNY4BQyvI5RzutUn8T5KbTRMAIAZOlJ/view?usp=sharing Steps to reproduce: 1. Create a group...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description There is a stored xss in member profile in the full name 🕵️♂️ Proof of Concept Steps to Reproduce: 1. Create a member account. 2. Login into the member account. 3. Enter the s"' payload in the Full Name field. 4. Update the profile and You will see an alert. 💥 Impact Stored XSS...