Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Register a student account and go to the...

WordPress plugin Premium Packages - Sell Digital Products Securely Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

YznCMS 跨站请求伪造漏洞

YznCMS is a backend development framework. A cross-site request forgery vulnerability exists in YznCMS v1.1.0, which stems from insufficiently verifying that a request comes from a trusted user in /public/admin/profile/update.html. An attacker could exploit this vulnerability by constructing a PO...

WordPress Plugin MStore API 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2022-48091

Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting XSS via processupdateprofile.php...

CVE-2022-48091

Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting XSS via processupdateprofile.php...

PT-2023-15569 · Unknown · Tramyardg Hotel-Mgmt-System

Name of the Vulnerable Software and Affected Versions: Tramyardg hotel-mgmt-system version 2022.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the process update profile.php file. Recommendations: For Tramyardg hotel-mgmt-system version 2022.4,...

Hotel-Mgmt-System 跨站脚本漏洞

Hotel-Mgmt-System is a hotel management system. A security vulnerability exists in Hotel-Mgmt-System version 2022.4, which stems from its processupdateprofile.php component that allows attackers to implement cross-site scripting...

Sql injection

A vulnerability was found in barronwaffles dwcnetworkserveremulator. It has been declared as critical. This vulnerability affects the function updateprofile of the file gamespy/gsdatabase.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated...

dwc_network_server_emulator SQL注入漏洞

dwcnetworkserveremulator is a Nintendo DS and Wii online multiplayer server emulator by barronwaffles individual developer. An SQL injection vulnerability exists in dwcnetworkserveremulator, which stems from a problem with the function updateprofile in the file gamespy/gsdatabase.py, where...

PT-2022-9025 · Unknown · Dwc Network Server Emulator

Name of the Vulnerable Software and Affected Versions: barronwaffles dwc network server emulator affected versions not specified Description: A critical issue has been found in the dwc network server emulator, affecting the update profile function in the file gamespy/gs database.py. The...

CVE-2022-43050

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component updateprofile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-26730 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the update profile.php component. This allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-38351

A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...

CVE-2022-38351

A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...

PT-2022-24382 · Suprema · Suprema Biostar 2

Name of the Vulnerable Software and Affected Versions: Suprema BioStar aka Bio Star 2 version 2.8.16 Description: A vulnerability in the software allows attackers to escalate privileges to System Administrator via a crafted PUT request to the "update profile page" API endpoint. This issue enables...

CVE-2022-38351: Improper Privilege Management

A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...

CVE-2021-41651

A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in processupdateprofile.php...

CVE-2021-24654

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attack...

CVE-2021-25791

Multiple stored cross site scripting XSS vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields...