636 matches found
PT-2021-11086
Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A PHP object injection bug in profile.php unserializes the untrusted data of the strProfileData POST-variable, allowing an unauthenticated attacker to execute code via a crafted POST request...
PT-2021-11085
Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A SQL injection issue allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request to the profile.php file, specifically via the strQuery parameter...
Design/Logic Flaw
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field...
Cross site scripting
A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...
CVE-2020-24194
A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...
CVE-2020-24194
CVE-2020-24194 is an XSS vulnerability in SourceCodester Daily Tracker System v1.0, exploitable via the fullname parameter in user-profile.php to inject arbitrary web script/HTML. The provided connected documents confirm the issue but do not specify affected versions beyond v1.0, nor provide a re...
Reside Property Management 3.0 - (profile) SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Reside Property Management 3.0 - 'profile' SQL Injection Google Dork: "Copyright 2020 Reside Property Management" Exploit Author: Ultra Security Team Ashkan Moghaddas , AmirMohammad Safari Team Members: Behzad Khalifeh , Milad...
CVE-2020-10436
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/my-profile.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/my-profile.php by adding a question mark ? followed by the payload...
CVE-2012-5776
Dokeos 2.1.1 has multiple XSS issues involving "extra" parameters in main/auth/profile.php...
CVE-2020-5510
PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file...
CVE-2020-5510
PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file...
Zechat 1.5 - uname SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Zechat 1.5 - 'uname' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://bylancer.com/ Software Link: https://bylancer.com/products/zechat-php-script/index.php Version: 1.5 Category: Webapps Tested on:...
Zechat 1.5 - 'uname' SQL Injection
Exploit Title: Zechat 1.5 - 'uname' SQL Injection Exploit Author: Ihsan Sencan Date: 2018-10-02 Dork: N/A Vendor Homepage: https://bylancer.com/ Software Link: https://bylancer.com/products/zechat-php-script/index.php Version: 1.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A POC: 1...
laxmihospital.com XSS vulnerability
Open Bug Bounty ID: OBB-676516 Description| Value ---|--- Affected Website:| laxmihospital.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-15187
CVE-2018-15187 concerns PHP Scripts Mall’s advanced-real-estate-script v4.0.9, where a Cross-Site Request Forgery (CSRF) flaw in edit-profile.php enables unauthorized actions. The CVSS details indicate a high-severity impact (CVSS3 8.0, HIGH; vector: NETWORK, LOW attack complexity, PR: LOW, UI: R...
CVE-2018-15187
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php...
luzdoislam.com.br Improper Access Control vulnerability
Open Bug Bounty ID: OBB-636444 Description| Value ---|--- Affected Website:| luzdoislam.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...
WordPress User Role Editor Plugin Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress User Role Editor plugin prior to v4.25, is lacking an...