Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request...

CVE-2024-22409: Incorrect Default Permissions

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR 9067 to...

XWiki Platform Code Injection Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in the XWiki Platform that originates from the execution of arbitrary script macros, including Groovy and Python macros that can cause remot...

Active Super Shop 1.5.1 HTML Injection

==================================================================================================================================== | Title : Active super shop v1 5.1 HTML inject Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...

Active Super Shop 1.5.2 HTML Injection

==================================================================================================================================== | Title : Active super shop v1.5.2 HTML inject Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...

CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...

CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places...

PT-2023-20455 · Xwiki · Xwiki Commons

Name of the Vulnerable Software and Affected Versions: XWiki Commons versions 3.1-milestone-1 through 13.10.8 XWiki Commons versions 14.0.0 through 14.4.3 XWiki Commons versions 14.5.0 through 14.7RC0 Description: The issue allows any user to edit their own profile and inject code, which is...

SUSE CVE-2016-3729

The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator...

CVE-2022-2273 Simple Membership < 4.1.3 - Membership Privilege Escalation

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

Simple Membership < 4.1.3 - Membership Privilege Escalation

The plugin does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request. Note: This only affects membership from the plugin, not the WordPress role PoC To increase the level, the attacker...

ProjeQtOr Project Management 9.1.4 - Remote Code Execution Vulnerability

Exploit Title: ProjeQtOr Project Management 9.1.4 - Remote Code Execution Exploit Author: Temel Demir Vendor Homepage: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV9.1.4.zip Version: v9.1.4 Tested on: Laragon @WIN10 Description : Remote co...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Membership & Learning Management System Plugin for WordPress plugin prior to version 4.21.1, which stems from the plugin generating...

PT-2021-19812 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 11.10.13 XWiki Platform versions prior to 12.6.7 XWiki Platform versions prior to 12.10.2 Description: A user disabled on a wiki using email verification for registration can re-activate themselves by using th...

CVE-2018-20642

PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service outage of profile editing via crafted JavaScript code in the KeySkills field...

CVE-2018-20642

CVE-2018-20642 affects PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1. The vulnerability is triggered by crafted JavaScript in the KeySkills field, causing a denial of service (outage of profile editing). Documents confirm the affected product and root cause (malformed input in KeySkills) ...

CVE-2017-17903

FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...

Moodle 2.8.x < 2.8.12 / 2.9.x < 2.9.6 / 3.0.x < 3.0.4 Multiple Vulnerabilities

Binary data 9427.prm...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 an uploaded profile picture or 2 the edit parameter to profiles/index.php...

Moodle 2.7 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Moodle 2.7 Persistent XSS Vendor: https://moodle.org/ Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265 Researched by: Osanda Malith Jayathissa @OsandaMalith E-Mail: osandacatunseen.is Original write-up:...