CVE-2025-4523

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admindonorprofileview function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with...

[20240804] - Core - Improper ACL for backend profile view

Improper Access Controls allows backend users to overwrite their username when disallowed...

CVE-2024-5113

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /view/studentprofile1.php. The manipulation of the argument stdindex leads to sql injection. The attack may be initiated...

Complete Web-Based School Management System SQL注入漏洞

Campcodes Complete Web-Based School Management System is a web-based school management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Web-Based School Management System version 1.0, which originates from an unknown function in /view/studentprofile.php that...

PT-2024-34530 · Campcodes · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A critical issue has been discovered, affecting the /view/student profile.php file. The manipulation of the std index argument leads to SQL injection. This issue c...

CVE-2021-24308

The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. Thi...

Voten.co Arbitrary Code Execution Vulnerability

Voten.co is an open source blogging community system. A security vulnerability exists in the resources/views/layouts/app.blade.php file in versions of Voten.co prior to 2017-08-25. An attacker can exploit the vulnerability to execute arbitrary JavaScript code when a user views the attacker's...

Information Disclosure

Moodle is vulnerable to information disclosure. The vulnerability exists because the forceloginforprofiles setting is not properly enforced, allowing guest users to view anyone's profile without permission...

jamesbaird.ca XSS vulnerability

Vulnerable URL: http://jamesbaird.ca/profileview.php?id=13'" Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 09:57 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 13720900 VIP website status:| No Check...

HackerOne: Control Characters Not Stripped From Username on Signup

Hey, To be honest, I'm not sure if there is any real security implications of this bug, but it's IMO something which should be fixed at some point since it'll be pretty easy. On signup, the username you chose has to be alphanumeric. If you submit someone else's username, followed by a null-byte...

Devana 'id' SQL Injection Vulnerability

Devana is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wazzum Dating Software - userid SQL Injection

Wazzum Dating Software - userid SQL Injection Wazzum Dating Software userid SQL Injection Vulnerability Author: nuclear site: http://www.wazzum.com/ vuln: http://localhost/path/profileview.php?userid=-1 union select 1,2,3,4,5,@@version / demo:...

Wazzum Dating Software (userid) SQL Injection Vulnerability

No description provided by source. Wazzum Dating Software userid SQL Injection Vulnerability Author: nuclear site: http://www.wazzum.com/ vuln: http://localhost/path/profileview.php?userid=-1 union select 1,2,3,4,5,@@version / demo:...

CVE-2008-5845

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...

Design/Logic Flaw

The 1 login, 2 admin profile edit, 3 reminder, 4 edit profile, 5 profile view, 6 gallery view, 7 gallery comment, and 8 gallery feedback capabilities in web-app.org WebAPP before 0.9.9.7 do not verify presence of users in memberlist.dat, which has unknown impact and remote attack vectors...