CVE-2026-1271

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pmuploadimage' and 'pmuploadcoverimage' AJAX actions. This is due to the updateusermeta function being called outsi...

EUVD-2026-4756

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2...

EUVD-2020-29659

Malware in sbrugna...

EUVD-2025-26395

Malicious code in bioql PyPI...

EUVD-2024-36003

Malicious code in bioql PyPI...

CVE-2025-41031

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...

Autodesk: IDOR Vulnerability Allowing Unauthorized Profile Picture Change

An IDOR vulnerability was found on the Autodesk User Profile, which allowed an attacker to edit another user's profile picture. The vulnerability was reported and has been fixed by Autodesk...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multi-modal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version 7.3.0 and earlier, which can be exploited to alter a profile picture and perform a stored cross-site scripting XSS attack,...

How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link

It's 2019, and just clicking on a specially crafted URL would have allowed an attacker to hack your Facebook account without any further interaction. A security researcher discovered a critical cross-site request forgery CSRF vulnerability in the most popular social media platform that could have...