CVE-2022-33219

CVE-2022-33219 describes a memory corruption in Automotive within Qualcomm chipsets caused by an integer overflow that transitions to a buffer overflow when registering a new listener with a shared buffer. The NVD entry notes a high/critical impact (CONF/INTE/A) with local attack vector and low c...

Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit...

Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

WordPress plugin User Post Gallery 命令注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A command injection vulnerability...

Kiwi TCMS 安全漏洞

Kiwi TCMS is a leading open source test management system for manual and automated testing from Kiwi TCMS Open Source. A security vulnerability exists in Kiwi TCMS version 11.6 and prior versions, which stems from the fact that when a user registers for a new account or changes their password,...

authentik 授权问题漏洞

authentik is an open source identity provisioning application from authentik Open Source. Authentik suffers from an authorization issue vulnerability that stems from vulnerability to incorrect authentication, where token reuse in the invitation URL leads to bypassing access control by using a...

Cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is...

CVE-2022-4738 SourceCodester Blood Bank Management System User Registration cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is...

CVE-2022-4738 SourceCodester Blood Bank Management System User Registration cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is...

PT-2022-28053 · Sourcecodester · Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Blood Bank Management System version 1.0 Description: A problematic vulnerability has been found in the User Registration Handler component. The issue affects an unknown function of the file index.php?page=users. The manipulati...

Bank Management System 跨站脚本漏洞

Bank Management System is a bank management system. A cross-site scripting vulnerability exists in SourceCodester Blood Bank Management System version 1.0, which stems from an unknown function in the index.php?page=users file of its User Registration Handler component that operates on the paramet...

Reddit: oauth misconfigration lead to account takeover

Vulnerability description not provided...

CVE-2022-4024

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users along with their posts...

CVE-2022-4024

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users along with their posts...

Cross site request forgery (csrf)

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users along with their posts...

CVE-2022-4024

The CVE-2022-4024 issue affects the Registration Forms WordPress plugin prior to version 3.8.1.3. It allows unauthenticated attackers to delete arbitrary users (and their posts) via an init action handler due to missing authorization checks and CSRF protection. The vulnerability is evidenced acro...

WordPress plugin Registration Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

The vulnerability of the Windows Error Reporting error reporting service on Windows operating systems allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Error Reporting registration service in Windows operating systems is related to synchronization errors when using a shared resource “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

CVE-2022-3912

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example...