CVE-2020-24912

A reflected cross-site scripting (XSS) vulnerability in QCubed, affecting all versions including 3.1.1, resides in profile.php via the stQuery- parameter. Unauthenticated attackers can steal sessions of authenticated users by exploiting this flaw. The Nuclei template and related advisories confir...

CVE-2020-24912

A reflected cross-site scripting XSS vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users...

PT-2021-11086

Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A PHP object injection bug in profile.php unserializes the untrusted data of the strProfileData POST-variable, allowing an unauthenticated attacker to execute code via a crafted POST request...

CVE-2020-24913: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...

PT-2021-11085

Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A SQL injection issue allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request to the profile.php file, specifically via the strQuery parameter...

CVE-2020-24914: Deserialization of Untrusted Data

A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...

CVE-2020-24912: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users...

Design/Logic Flaw

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field...

PT-2021-16990

Name of the Vulnerable Software and Affected Versions PHPGurukul Daily Expense Tracker System version 1.0 Description The issue concerns a stored XSS vulnerability via the Full Name field in the user-profile.php page. This allows for malicious scripts to be stored and executed when the page is...

CVE-2021-26303: Improper Neutralization of Input During Web Page Generation

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field...

CVE-2020-36156

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

PT-2021-11937

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: An issue allows authenticated privilege escalation via profile update. Any user with access to the profile.php page can supply the parameter um-role with a value set to any role, su...

CVE-2020-36156: Improper Privilege Management

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

PT-2020-15586

Name of the Vulnerable Software and Affected Versions SourceCodester Online Course Registration version 1.0 Description A File Upload issue allows remote attackers to achieve Remote Code Execution RCE on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload...

CVE-2020-23828: Unrestricted Upload of File with Dangerous Type

A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution RCE on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload filters. An attack uses...

Cross site scripting

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

CVE-2020-24194

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

CVE-2020-24194

CVE-2020-24194 is an XSS vulnerability in SourceCodester Daily Tracker System v1.0, exploitable via the fullname parameter in user-profile.php to inject arbitrary web script/HTML. The provided connected documents confirm the issue but do not specify affected versions beyond v1.0, nor provide a re...

CVE-2020-24194: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

Reside Property Management 3.0 - (profile) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Reside Property Management 3.0 - 'profile' SQL Injection Google Dork: "Copyright 2020 Reside Property Management" Exploit Author: Ultra Security Team Ashkan Moghaddas , AmirMohammad Safari Team Members: Behzad Khalifeh , Milad...