CVE-2026-105809

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809

A cross-site scripting (XSS) vulnerability exists in SourceCodester Simple Student Information System 1.0 . The flaw is located in the Profile Field Handler component, specifically within the register.php file. Attackers can initiate a remote attack by manipulating the firstname or lastname argum...

EUVD-2026-93226

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

auto-cve-2022-44268.sh

auto-cve-2022-44268 Automatizando la explotación de CVE-2022-44268 ImageMagick Arbitrary File Read Hallazgo original: https://www.metabaseq.com/imagemagick-zero-days/ Repositorio del PoC: https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC Descripción ImageMagick...

CVE-2026-93428

The Ultimate Member plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.13.1 . The root cause is the plugin's failure to properly verify user authorization when accessing the publicly available wp_ajax_nopriv_um_get_members endpoint. Specifically, t...

EUVD-2026-91881

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2025-45805

CVE-2025-45805 Poc Of CVE-2025-45805 Affected Product: Doctor Appointment Management System Vendor: phpgurukul Version: 1.0 Vulnerability Type: Stored Cross-Site Scripting XSS Description: An authenticated doctor user can inject arbitrary JavaScript code into the doctor profile field name/employe...

PT-2026-98395

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.7 Description Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the profile update action. The raw $ POST'data' array is copied...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-93769

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability. The flaw allows any user with the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title . This vulnerability can occu...

EUVD-2026-85361

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

PT-2026-97370

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.5 Description A stored cross-site scripting XSS issue exists where a user with the delegated, non-system-administrator admin manage users permission can inject persistent HTML or JavaScript into a Profile Field Category...

CVE-2026-93769: Improper Neutralization of Input During Web Page Generation

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

PT-2026-89856

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filter var..., FILTER VALIDATE URL, which...

CVE-2026-18547

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....