CVE-2019-19658

CVE-2019-19658 Chevereto 저장 XSS - 프로필 페이지에서 - 1.0.0 - 1.1.4 무료 버전, 등록된 사용자가 이름 필드에 스크립트를 주입합니다. 이 경우 사용자를 Google로 리디렉션합니다. 누군가 /test 프로필에 접속하면 리디렉션됩니다...

CVE-2024-39031

CVE-2024-39031 : Silverpeas Core Stored XSS in in Mes agendas 정보 설명: Mes Agendas에서 사용자는 새 이벤트를 생성하고 캘린더에 추가할 수 있습니다. 또한 사용자는 동일한 도메인의 다른 사용자관리자 포함를 이벤트에 초대할 수 있습니다. 일반 사용자는 이벤트 생성 시 "Titre" 및 "Description" 필드에 XSS 페이로드를 삽입한 후 관리자나 다른 사용자를 이벤트에 추가할 수 있습니다. 초대된 사용자피해자가 자신의 프로필을 볼 때, 이벤트를 클릭하지 않아도 피...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-82519

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

PT-2026-91411

Name of the Vulnerable Software and Affected Versions Really Simple Security plugin for WordPress versions prior to 9.8.2 Description An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication...

CVE-2026-82519: Missing Authorization

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2021-24299

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:41+00:00| seen| https://t.me/hackingAttack/9959 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/9959 2026-09-08 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/9959 2026-09-09 00:00:40+00:00|...

EUVD-2026-63371

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...

CVE-2026-76634: Authorization Bypass Through User-Controlled Key

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-12696

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

CVE-2026-12696

The wpForo Forum WordPress plugin (versions before 3.1.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize and escape a user profile field (specifically the Profile Location Field ) before it is rendered inside an HTML attribute on the public p...

CVE-2026-12696 wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

PT-2026-67015

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

PT-2026-66582

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1...

PT-2026-65399

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...