UBUNTU-CVE-2019-13239

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

Cross site scripting

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

CVE-2019-13239

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

CVE-2019-13239: Improper Neutralization of Input During Web Page Generation

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

PT-2019-11675 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 Description: An issue in the Ultimate Member plugin for WordPress allows unauthorized modification of user profiles and cover pictures. Once connected, an attacker can modify the profile and cover picture o...

CVE-2019-10271: Undefined Security Weakness

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

CVE-2019-12895

In Alternate Pic View 2.600, the Exception Handler Chain is Corrupted starting at PicViewer!PerfgrapFinalize+0x00000000000b916d...

CVE-2019-9605

PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting XSS via the err value in a .ico picture upload...

Cross site scripting

PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting XSS via the err value in a .ico picture upload...

CVE-2019-9605: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting XSS via the err value in a .ico picture upload...

DEBIAN-CVE-2019-9752

An issue was discovered in Open Ticket Request System OTRS 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This ...

CVE-2019-9693

In CMS Made Simple CMSMS before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow parameter showid, inputshow parameter showid, Getshowinfo parameter showid, Getpictureinfo parameter pictureid, AdjustNameSeq parameter shownumber,...

glpi -- stored XSS

MITRE Corporation reports: inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

CVE-2019-9052

Pluck CMS 4.7.9-dev1 is affected by a CSRF vulnerability that enables an attacker to delete images via the URI /admin.php?action=deleteimage&var1=. This is documented across multiple sources (e.g., CVE-2019-9052, CNVD-2019-05783) indicating an unauthenticated or cross-site request scenario where ...

How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link

It's 2019, and just clicking on a specially crafted URL would have allowed an attacker to hack your Facebook account without any further interaction. A security researcher discovered a critical cross-site request forgery CSRF vulnerability in the most popular social media platform that could have...

S-CMS SQL Injection Vulnerability (CNVD-2018-26678)

S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in S-CMS version 1.0, which can be exploited by remote attackers to execute SQL commands by sending the 'Pid' parameter to the js/pic.php file...

CVE-2018-1000839

LH-EHR version REL-200 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type...

CVE-2018-1000839

LH-EHR version REL-200 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type...

Design/Logic Flaw

LH-EHR version REL-200 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type...

CVE-2018-1000839

LH-EHR version REL-200 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type...