Improper access control

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through...

CVE-2022-30290

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through...

CVE-2022-30290

CVE-2022-30290 affects OpenCTI up to version 5.2.4, where a broken access control issue in the profile endpoint lets an attacker change their registered email and API key despite these actions not being possible through the legitimate interface. Affected component: profile endpoint in OpenCTI. Ro...

PT-2022-20050 · Opencti · Opencti

Name of the Vulnerable Software and Affected Versions: OpenCTI versions 5.2.4 and earlier Description: A broken access control issue has been identified in the profile endpoint. This allows an attacker to change their registered e-mail address and API key, despite this action not being possible...

Advanced School Management System SQL注入漏洞

Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /getteacherprofile.php?myindex=The page lacks validation for external input SQL...

FEBS-Security 安全漏洞

FEBS-Security is a simple and efficient backend privilege management system. A security vulnerability exists in FEBS-Security v1.0, which stems from insecure permissions configured in the userid parameter of /user/getuserprofile, allowing an attacker to access and arbitrarily modify a user's...

Subrion Cross-Site Scripting Vulnerability (CNVD-2020-75156)

Subrion is a powerful and easy to use PHP content management system with full source editing, per page permissions, user activity monitoring and other powerful features. A cross-site scripting vulnerability exists in Subrion 4.2.1. The vulnerability can be exploited to conduct a cross-site...

CVE-2020-26177

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

PT-2020-13387 · Cacti +3 · Cacti +3

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.11 Description: The issue allows for a Cross-Site Request Forgery CSRF attack, which can be used to change an admin's email address. This can be achieved through the "auth profile.php?action=edit" endpoint...

CVE-2017-15962

iStock Management System 1.0 allows Arbitrary File Upload via user/profile...

partner.superdeal.ua XSS vulnerability

Vulnerable URL: https://partner.superdeal.ua/partner/profile Details: Description| Value ---|--- Patched:| Yes, at 20.07.2017 Latest check for patch:| 20.07.2017 11:33 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| ...

PT-2005-4395 · Ekinboard · Ekinboard

Name of the Vulnerable Software and Affected Versions: Ekinboard version 1.0.3 Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the id parameter in the "profile.php" endpoint and the...