YunoHost Cross-Site Scripting Vulnerability

YunoHost is a Linux-based server operating system. A cross-site scripting vulnerability exists in the profile edit page of the user panel in YunoHost versions 2.7.2 through 2.7.14. A remote attacker can exploit this vulnerability by injecting JavaScript code to manipulate user sessions...

FUEL CMS Cross-Site Request Forgery Vulnerability

FUEL CMS is a content management system based on CodeIgniter. A cross-site request forgery vulnerability exists in myprofile/edit?inline= in FUEL CMS 1.4, which can be exploited by remote attackers to change the administrator password...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-17868)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited ...

CVE-2018-0590

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

CVE-2018-6902

PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action...

Design/Logic Flaw

Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17893

Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...

CVE-2017-17893

Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...

Design/Logic Flaw

Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

WordPress: [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint

Hi, In a similar manner to 228569, it is currently possible to execute authenticated open redirections via the wphttpreferer parameter used in the BuddyPress extended user edit screen. Proof of concept Upon accessing the below URL, please select the "Update Profile" button, then select the "←Back...

urlaubspiraten.de XSS vulnerability

Vulnerable URL: https://www.urlaubspiraten.de/user/profile/travel-alarms/14183/edit Details: Description| Value ---|--- Patched:| Yes, at 11.02.2017 Latest check for patch:| 11.02.2017 21:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 17517 VIP website...

Square: XSS on bookfresh

Hi, Xss is triggered on https://www.bookfresh.com/cindex.php/profile/edit/cs/staffmember Payload: %22onmouseover%3Dprompt%281%29%20mik%22 Steps to reproduce Create a new staff and put our payload on the name of the staff. Refresh the page Edit the staff and mouseover to the name of the staff and...

Moodle 2.7 Cross Site Scripting

Title: Moodle 2.7 Persistent XSS Vendor: https://moodle.org/ Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265 Researched by: Osanda Malith Jayathissa @OsandaMalith E-Mail: osandacatunseen.is Original write-up: http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xs...

ZEEJOBSITE 2.0 - Remote File Upload Vulnerability

No description provided by source. ZEEJOBSITE v2.0 remote file Upload author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com dork: [email protected] date: 08/11/2008 aha simdi gönderiyorum saat 10:40 : first register to site you add this code your shell to head GIF89a;...

PunBB 1.x Profile.PHP User Profile Edit Module SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14195/info PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module of the 'profile.php' script...

FlexCMS 3.2.1 Cross Site Request Forgery

+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : FlexCMS 3.2.1 Multiple CSRF Date : 16-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...