157 matches found
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the Address field as tested on the latest release. 🕵️♂️ Proof of Concept Steps to Reproduce: 1. Create a user account. 2. Login into the user account. 3. Enter the s"' payload in the...
CVE-2021-3298
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter...
Cross site scripting
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter...
CVE-2021-3298
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter...
Collabtive 3.1 - 'address' Persistent Cross-Site Scripting
Exploit Title: Collabtive 3.1 - 'address' Persistent Cross-Site Scripting Date: 2021-01-23 Exploit Author: Deha Berkin Bir Vendor Homepage: https://collabtive.o-dyn.de/ Version: 3.1 Tested on: Windows & XAMPP CVE: CVE-2021-3298 == Tutorial Executed Payloads " onfocus="alert1" autofocus=" HTML...
DEBIAN-CVE-2020-13231
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...
Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role
The plugin is affected by a broken authentication vulnerability, allowing unauthenticated users to register or edit their account and gain the Administrator role using the plugin's forms. The vulnerability only exists in the Plugin's own generated Registration Form or Profile Edit Form. This mean...
CVE-2019-7552
An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section...
CVE-2019-11218
CVE-2019-11218 affects Bonobo Git Server prior to 6.5.0, where improper handling of extra parameters in AccountController (User Profile edit) allows authenticated users to escalate privileges to application administrator. The issue is triggered by additional form parameters and is documented acro...
CVE-2019-11218
Improper handling of extra parameters in the AccountController User Profile edit in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated users to gain application administrator privileges via additional form parameter submissions...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
Design/Logic Flaw
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
Adianti Framework 5.5.0 SQL Injection
Exploit Title: SQL Injection in Adianti Framework Date: 2018-12-18 Exploit Author: Joner de Mello Assolin Vendor Homepage: https://www.adianti.com.br Version: 5.5.0 and 5.6.0 REQUIRED Tested on: XAMPP Version 7.2.2, phpMyAdmin 4.7.7 and 4.8.4, PHP 7.1 , Apache/2.4.29 Win32 , libmysql - mysqlnd...
YunoHost Cross-Site Scripting Vulnerability
YunoHost is a Linux-based server operating system. A cross-site scripting vulnerability exists in the profile edit page of the user panel in YunoHost versions 2.7.2 through 2.7.14. A remote attacker can exploit this vulnerability by injecting JavaScript code to manipulate user sessions...
FUEL CMS Cross-Site Request Forgery Vulnerability
FUEL CMS is a content management system based on CodeIgniter. A cross-site request forgery vulnerability exists in myprofile/edit?inline= in FUEL CMS 1.4, which can be exploited by remote attackers to change the administrator password...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-17868)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited ...