CVE-2025-30369 Zulip allows the deletion of Custom profile fields by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any...

CVE-2025-30369 Zulip allows the deletion of Custom profile fields by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any...

BIT-MOODLE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

BIT-MOODLE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

PT-2024-12979 · Undefined · Undefined

NCC Group выпустила третье исследование с оценкой безопасности популярных инструментов RMM, в котором представила обзор на 18 уязвимостей в PandoraFMS. Ранее в поле зрения исследователей попадали множественные уязвимости в Faronics Insight и Nagios XI. PandoraFMS - это приложение для мониторинга ...

CVE-2023-31295

CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the User Profile field...

CVE-2023-31295

CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the User Profile field...

CVE-2023-31295

CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the User Profile field...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

auto-cve-2022-44268 Automating expl...

Authentication flaw

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

CVE-2023-2431

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined seccomp...

GHSA-72W2-J52C-7682 Moodle SQL Injection vulnerability

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

Moodle SQL Injection vulnerability

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

Sql injection

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

CVE-2023-28329 concerns Moodle with an authenticated SQL injection via the profile field availability check. Documented affected ranges include Moodle 3.11–3.11.14, 4.0–4.0.8, 4.1–4.1.3, and 4.2. Affected vendor notes describe insufficient validation enabling SQL injection when retrieving profile...