15972 matches found
ZOHO ManageEngine Endpoint Central security vulnerabilities
ZOHO ManageEngine Endpoint Central is a desktop management system from ZOHO USA. A security vulnerability exists in ZOHO ManageEngine Endpoint Central versions prior to 11.3.2440.09. An attacker can exploit the vulnerability to change usernames in chat...
PT-2025-5696 · Zoho · Manageengine Endpoint Central
Name of the Vulnerable Software and Affected Versions: ManageEngine Endpoint Central versions before 11.3.2440.09 Description: The issue allows an attacker to change the username in the chat due to an IDOR vulnerability. Recommendations: For ManageEngine Endpoint Central versions before...
CVE-2024-9097: Authorization Bypass Through User-Controlled Key
ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat...
CVE-2024-8368
A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched...
CVE-2025-22601
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are...
CVE-2025-22601 Client Side Path Traversal using activate account route in Discourse
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are...
CVE-2025-22601 Client Side Path Traversal using activate account route in Discourse
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are...
CVE-2025-24967: Improper Neutralization of Input During Web Page Generation
reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting XSS vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This...
PT-2025-4589
Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description Discourse is an open source platform for community discussion. In affected versions, an attacker can trick a target user to make changes to their own username via a carefully crafted...
CVE-2025-22601: Improper Limitation of a Pathname to a Restricted Directory
Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the activate-account route. This problem has been patched in the latest version of Discourse. Users are...
Discourse path traversal vulnerability
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a path traversal vulnerability that stems from the fact that an attacker can leverage the activate-account route via a...
CVE-2025-0971
A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attac...
SourceCodester Packers and Movers Management System security vulnerabilities
SourceCodester Packers and Movers Management System is an open source packers and movers management system from Sourcecodester. A security vulnerability exists in version 1.0 of the SourceCodester Packers and Movers Management System, which stems from a cross-site scripting vulnerability in...
Zenvia code injection vulnerability
Zenvia is a complete customer service software from Zenvia, Inc. A code injection vulnerability exists in Zenvia version 25.01.22 and prior versions, which stems from an incorrect manipulation of the parameter username that can lead to cross-site scripting attacks...
PT-2025-3463 · Sourcecodester · Sourcecodester Packers/Movers Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Packers and Movers Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS problem in the Users.php file. An attacker can inject a malicious script into the username or name field during user...
CVE-2024-57522: Improper Neutralization of Input During Web Page Generation
SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting XSS in Users.php. An attacker can inject a malicious script into the username or name field during user creation...
CVE-2025-0971: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attac...
PT-2025-4117 · Zenvia · Zenvia Movidesk
Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of t...
GHSA-R2X6-CJG7-8R43 snowflake-connector-python vulnerable to insecure cache files permissions
Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects version...