CVE-2026-33631

creationtimestamp| type| source ---|---|--- 2026-03-26 19:16:16+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33631 2026-03-26 19:59:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyfdfj4ke2z 2026-03-26 21:01:02+00:00| seen|...

CVE-2026-33009

creationtimestamp| type| source ---|---|--- 2026-03-26 18:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyb5mpmwy2d 2026-03-26 22:22:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyndnlegi2d...

CVE-2026-29934

creationtimestamp| type| source ---|---|--- 2026-03-26 17:24:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4ohoqaj2d...

CVE-2026-22790

creationtimestamp| type| source ---|---|--- 2026-03-26 17:18:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4d4jkjt22 2026-03-26 23:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhypijukn62h 2026-03-31 15:00:14+00:00| seen|...

CVE-2026-4867

creationtimestamp| type| source ---|---|--- 2026-03-26 16:03:27+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhxy56xqkc27 2026-03-26 22:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhym5fbmva2x 2026-04-17 03:37:07+00:00| seen|...

CVE-2026-33396

creationtimestamp| type| source ---|---|--- 2026-03-26 15:22:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxvugheqw2s 2026-03-26 22:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhym373t2q2c 2026-03-26 23:01:26+00:00| seen|...

CVE-2025-69727

An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...

CVE-2025-67298

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

CVE-2026-4574

A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now...

CVE-2024-51223

A stored cross-site scripting XSS vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Mobile Number parameter...

CVE-2024-51222

A stored cross-site scripting XSS vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...

CVE-2025-69241

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

CVE-2026-3111

Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/ID/username/thumbAAxAA.jpg' translated as 80x90 and 40x45. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of...

CVE-2026-32866

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The...

CVE-2026-32099

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has hideprofile enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's...

CVE-2026-33683

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xssesc function...

CVE-2026-33051

Craft CMS is a content management system CMS. In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw combined with Craft::t string interpolation. A low-privileged control panel user...

CVE-2026-4191

A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...

CVE-2026-3629

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'saveextrauserprofilefields' function not properly restricting which user meta keys can be updated via profile fields. The...

CVE-2026-29792

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's...