172 matches found
DEBIAN-CVE-2020-13231
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...
Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role
The plugin is affected by a broken authentication vulnerability, allowing unauthenticated users to register or edit their account and gain the Administrator role using the plugin's forms. The vulnerability only exists in the Plugin's own generated Registration Form or Profile Edit Form. This mean...
CVE-2019-7552
An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section...
CVE-2019-11218
Improper handling of extra parameters in the AccountController User Profile edit in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated users to gain application administrator privileges via additional form parameter submissions...
CVE-2019-11218
CVE-2019-11218 affects Bonobo Git Server prior to 6.5.0, where improper handling of extra parameters in AccountController (User Profile edit) allows authenticated users to escalate privileges to application administrator. The issue is triggered by additional form parameters and is documented acro...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
Design/Logic Flaw
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
CVE-2019-7432
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section...
Adianti Framework 5.5.0 SQL Injection
Exploit Title: SQL Injection in Adianti Framework Date: 2018-12-18 Exploit Author: Joner de Mello Assolin Vendor Homepage: https://www.adianti.com.br Version: 5.5.0 and 5.6.0 REQUIRED Tested on: XAMPP Version 7.2.2, phpMyAdmin 4.7.7 and 4.8.4, PHP 7.1 , Apache/2.4.29 Win32 , libmysql - mysqlnd...
YunoHost Cross-Site Scripting Vulnerability
YunoHost is a Linux-based server operating system. A cross-site scripting vulnerability exists in the profile edit page of the user panel in YunoHost versions 2.7.2 through 2.7.14. A remote attacker can exploit this vulnerability by injecting JavaScript code to manipulate user sessions...
FUEL CMS Cross-Site Request Forgery Vulnerability
FUEL CMS is a content management system based on CodeIgniter. A cross-site request forgery vulnerability exists in myprofile/edit?inline= in FUEL CMS 1.4, which can be exploited by remote attackers to change the administrator password...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-17868)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited ...
CVE-2018-0590
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...
CVE-2018-6902
PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action...
Design/Logic Flaw
Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to...
CVE-2017-17891
Readymade Video Sharing Script has CSRF via user-profile-edit.php...
CVE-2017-17891
Readymade Video Sharing Script has CSRF via user-profile-edit.php...