CVE-2026-32989

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations,...

Security update 5.1.2 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Non-customer-facing optimization around source building golang-github-lusitaniae-apacheexporter: Build without apparmor for openSUSE Leap 16, SLES 16 or newer Require Go 1.23 for building Update to version 1.0.1...

SVXportal 安全漏洞

SVXportal is a portal website developed by Peter as an individual developer. Versions of SVXportal 2.5 and earlier had security vulnerabilities. These vulnerabilities stemmed from insufficient encoding of user input fields during the profile update process, which could lead to stored-xss attacks...

CVE-2025-13821 User profile update exposes password hash and MFA secrets

Mattermost versions 11.1.x = 11.1.2, 10.11.x = 10.11.9, 11.2.x = 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID:...

CVE-2025-13821

Mattermost servers of versions 10.11.x <= 10.11.9 , 11.1.x <= 11.1.2 , and 11.2.x

Improper Input Validation

mantisbt/mantisbt is vulnerable to improper input validation. The vulnerability is due to lack of email ownership verification during profile updates, which allows an attacker to register an unauthorized email address and potentially cause information disclosure by redirecting notifications...

EUVD-2006-6803

Malware in sbrugna...

EUVD-2006-6804

Malware in sbrugna...

EUVD-2006-6805

Malware in sbrugna...

EUVD-2024-21979

Malicious code in bioql PyPI...

CVE-2025-6366 Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation

The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the elupdateprofile function. This makes it possible for authenticated...

GHSA-F946-J5J2-4W5M

creationtimestamp| type| source ---|---|--- 2025-07-02 14:36:58+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3lsygsqtgiy2f 2025-07-03 00:05:08+00:00| seen| https://bsky.app/profile/nixpkgs-prs-bot.bsky.social/post/3lszgkpezi726...

CVE-2025-6652

creationtimestamp| type| source ---|---|--- 2025-06-25 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-437/ 2025-06-25 21:50:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19539 2025-06-26 00:30:59+00:00| seen|...

CVE-2025-48875 FreeScout Vulnerable to Stored XSS

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of lastname and firstname during profile data updates allows for the injection of arbitrary JavaScript code, which will be executed in a flesh-message when the data is deleted...

CVE-2024-47475

creationtimestamp| type| source ---|---|--- 2025-01-06 17:13:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113782530450480818 2025-01-06 17:15:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf3n64ijdo22 2025-01-06 19:27:25+00:00| seen|...

VulnCheck KEV: CVE-2021-34624

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2023-6009

The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userproupdateuserprofile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify...

CVE-2023-24729

Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function...

PT-2023-19308 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 10.5.16 Description: The upload functionality for updating user profiles does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature e.g...

WordPress arbitrary file upload vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.The WordPress ProfilePress plugin is vulnerable to arbitrary file uploads, which can be exploited...