PT-2022-12934

Name of the Vulnerable Software and Affected Versions sourcecodester School File Management System version 1.0 Description The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the Lastname parameter to the Update Account form in the student profile.php file...

PT-2022-21278

Name of the Vulnerable Software and Affected Versions itsourcecode Advanced School Management System version 1.0 Description The issue allows for SQL Injection, which can be exploited via the "/school/model/get parents profile.php" API endpoint, specifically through the my index variable. This...

PT-2022-21277

Name of the Vulnerable Software and Affected Versions itsourcecode Advanced School Management System version 1.0 Description The issue concerns SQL Injection, which can be exploited via the "/school/model/get teacher profile.php" API endpoint, specifically through the my index variable. This allo...

PT-2022-20337

Name of the Vulnerable Software and Affected Versions Wedding Management System version 1.0 Description The issue concerns an arbitrary file upload vulnerability located in the picture upload point of the "users profile.php" file. Recommendations For Wedding Management System version 1.0, conside...

qcubed PHP object injection

A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...

GHSA-7W3C-JGH7-CWJW qcubed PHP object injection

A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...

GHSA-8FJ6-PC5R-347Q qcubed SQL injection vulnerability in profile.php via the strQuery parameter

A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...

qcubed SQL injection vulnerability in profile.php via the strQuery parameter

A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...

qcubed reflected cross-site scripting (XSS) vulnerability

A reflected cross-site scripting XSS vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users...

CVE-2022-29005: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters...

CVE-2022-28601: Incorrect Authorization

A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism...

PT-2022-19098

Name of the Vulnerable Software and Affected Versions Simple 2FA Plugin for Moodle affected versions not specified Description A Two-Factor Authentication 2FA bypass issue allows remote attackers to overwrite the phone number used for confirmation via the "profile.php" file, thereby bypassing the...

CVE-2022-27478

Victor CMS v1.0 contains a remote code execution (RCE) vulnerability exploitable through the component admin/profile.php?section=admin. The set of connected documents consistently describes an RCE without detailing the root cause or exact exploit path beyond the vulnerable endpoint. Impact is des...

CVE-2022-27478: Unrestricted Upload of File with Dangerous Type

Victor v1.0 was discovered to contain a remote code execution RCE vulnerability via the component admin/profile.php?section=admin...

PT-2022-18447

Name of the Vulnerable Software and Affected Versions Victor version 1.0 Description The issue is related to a remote code execution RCE vulnerability. It can be exploited via the admin/profile.php?section=admin endpoint. Recommendations For Victor version 1.0, consider restricting access to the...

CVE-2021-45003

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

Remote code execution

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

CVE-2021-45003

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

CVE-2021-45003: Incorrect Default Permissions

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

PT-2022-12285 · Unknown · Laundry Booking Management System

Name of the Vulnerable Software and Affected Versions: Laundry Booking Management System versions 1.0 and earlier Description: The issue is related to a remote code execution RCE vulnerability. It affects the profile.php file through the image parameter, allowing the execution of a webshell...