CVE-2025-13821

Mattermost servers of versions 10.11.x <= 10.11.9 , 11.1.x <= 11.1.2 , and 11.2.x

Improper Input Validation

mantisbt/mantisbt is vulnerable to improper input validation. The vulnerability is due to lack of email ownership verification during profile updates, which allows an attacker to register an unauthorized email address and potentially cause information disclosure by redirecting notifications...

EUVD-2006-6804

Malware in sbrugna...

EUVD-2006-6805

Malware in sbrugna...

EUVD-2006-6803

Malware in sbrugna...

EUVD-2024-21979

Malicious code in bioql PyPI...

CVE-2025-6366 Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation

The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the elupdateprofile function. This makes it possible for authenticated...

GHSA-F946-J5J2-4W5M

creationtimestamp| type| source ---|---|--- 2025-07-02 14:36:58+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3lsygsqtgiy2f 2025-07-03 00:05:08+00:00| seen| https://bsky.app/profile/nixpkgs-prs-bot.bsky.social/post/3lszgkpezi726...

CVE-2025-6652

creationtimestamp| type| source ---|---|--- 2025-06-25 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-437/ 2025-06-25 21:50:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19539 2025-06-26 00:30:59+00:00| seen|...

CVE-2025-48875 FreeScout Vulnerable to Stored XSS

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of lastname and firstname during profile data updates allows for the injection of arbitrary JavaScript code, which will be executed in a flesh-message when the data is deleted...

CVE-2024-47475

creationtimestamp| type| source ---|---|--- 2025-01-06 17:13:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113782530450480818 2025-01-06 17:15:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf3n64ijdo22 2025-01-06 19:27:25+00:00| seen|...

VulnCheck KEV: CVE-2021-34624

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2023-6009

The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userproupdateuserprofile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify...

CVE-2023-24729

Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function...

PT-2023-19308 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 10.5.16 Description: The upload functionality for updating user profiles does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature e.g...

WordPress arbitrary file upload vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.The WordPress ProfilePress plugin is vulnerable to arbitrary file uploads, which can be exploited...

CVE-2021-34624

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

Design/Logic Flaw

A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

Design/Logic Flaw

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...