28 matches found
EUVD-2015-2946
Malware in sbrugna...
EUVD-2006-1030
Malware in sbrugna...
CVE-2024-13344
The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-13344
The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-13344
The CVE-2024-13344 entry concerns the WordPress plugin Advance Seat Reservation Management for WooCommerce. Concrete details in connected sources confirm an unauthenticated SQL Injection via the profileId parameter in all versions up to and including 3.3, caused by insufficient escaping and lack ...
CVE-2024-13344: Improper Neutralization of Special Elements used in an SQL Command
The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2025-25711: Improper Preservation of Permissions
An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the /tnexus/rest/admin/updateUser API endpoint...
CVE-2025-25711
CVE-2025-25711 affects dtp.ae tNexus Airport View v2.8. A remote attacker can escalate privileges by manipulating the ProfileID value via the /tnexus/rest/admin/updateUser API endpoint. The issue is described as an elevation of privilege (ProfileID parameter misuse) with the public metrics indica...
Entrepreneur Dating Script SQL Injection Vulnerability
Entrepreneur Dating Script is a set of online dating site scripts. A SQL injection vulnerability exists in Entrepreneur Dating Script version 2.0.1. A remote attacker can inject SQL commands into the searchresult.php file by sending the 'marital', 'gender', or 'profileid ' parameter to the...
Sql injection
Entrepreneur Dating Script 2.0.1 has SQL Injection via the searchresult.php marital, gender, country, or profileid parameter...
CVE-2017-17648
Entrepreneur Dating Script 2.0.1 has SQL Injection via the searchresult.php marital, gender, country, or profileid parameter...
CVE-2017-17648
Entrepreneur Dating Script 2.0.1 has SQL Injection via the searchresult.php marital, gender, country, or profileid parameter...
CVE-2017-17648: Improper Neutralization of Special Elements used in an SQL Command
Entrepreneur Dating Script 2.0.1 has SQL Injection via the searchresult.php marital, gender, country, or profileid parameter...
Vulnerability in Datalex airline booking software
Datalex airline booking software is a suite of software from Datalex Ireland that automatically connects to airline bookings. A security vulnerability exists in Datalex airline booking software updated prior to date 2015-09-03. A remote attacker can exploit the vulnerability to read or access...
Code injection
Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to 1 ValidateFormAction.do or 2 ProfileConfirmEditAddressAction.do...
CVE-2015-2858
Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to 1 ValidateFormAction.do or 2 ProfileConfirmEditAddressAction.do...
Crowd OpenID server does not enforce profile ownership for viewing
Similar to CWD-3465, it seems that not enforce profile ownership for viewing. That is, a non-admin user called Mallory can view Alice's profile information if Mallory obtains Alice's profileId number. For example, https://openid.atlassian.com/secure/profile/editprofiles.action?profileID=15240744...
CVE-2013-2501
Cross-site scripting XSS vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field...
Cross site scripting
Cross-site scripting XSS vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field...