CVE-2026-105809

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809

A cross-site scripting (XSS) vulnerability exists in SourceCodester Simple Student Information System 1.0 . The flaw is located in the Profile Field Handler component, specifically within the register.php file. Attackers can initiate a remote attack by manipulating the firstname or lastname argum...

auto-cve-2022-44268.sh

auto-cve-2022-44268 CVE-2022-44268 ImageMagick 임의 파일 읽기 자동화 원본 발견: https://www.metabaseq.com/imagemagick-zero-days/ PoC 저장소: https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC 설명 ImageMagick은 "profile" 텍스트 문자열을 파일 이름 으로 해석 하고, 해당 콘텐츠를 원시 프로필로 로드 한 다음, 공격자가 리모트 파일의 콘텐츠를 포...

CVE-2026-93428

The Ultimate Member plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.13.1 . The root cause is the plugin's failure to properly verify user authorization when accessing the publicly available wp_ajax_nopriv_um_get_members endpoint. Specifically, t...

EUVD-2026-91881

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2025-45805

CVE-2025-45805 CVE-2025-45805의 PoC 영향받는 제품: Doctor Appointment Management System 공급업체: phpgurukul 버전: 1.0 취약점 유형: 저장형 크로스 사이트 스크립팅 XSS 설명: 인증된 의사 사용자는 의사 프로필 필드이름/직원 ID에 임의의 JavaScript 코드를 주입할 수 있습니다. 이 악성 페이로드는 환자가 예약을 위해 의사를 선택할 때 삭제sanitization 과정 없이 렌더링되어 피해자의 브라우저에서 임의의 스크립트가 실행될 수 있습니다. 이를 ...

PT-2026-98395

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.7 Description Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the profile update action. The raw $ POST'data' array is copied...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-93769

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

CVE-2026-93769

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability. The flaw allows any user with the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title . This vulnerability can occu...

EUVD-2026-85361

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

PT-2026-97370

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.5 Description A stored cross-site scripting XSS issue exists where a user with the delegated, non-system-administrator admin manage users permission can inject persistent HTML or JavaScript into a Profile Field Category...

CVE-2026-93769: Improper Neutralization of Input During Web Page Generation

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

PT-2026-89856

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filter var..., FILTER VALIDATE URL, which...

CVE-2026-18547

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547

CVE-2026-18547 affects the Ultimate Member WordPress plugin in all versions up to and including 2.12.1 . Authenticated attackers with subscriber-level access or above can exploit a stored XSS (DOM-based) by injecting malicious JavaScript through a textarea profile field with HTML support. The roo...