CVE-2023-29205

XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be...

CVE-2025-14582

A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is...

CVE-2025-14582

A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is...

CVE-2025-14582

A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is...

EUVD-2002-2155

Malware in sbrugna...

EUVD-2013-4743

Malware in sbrugna...

EUVD-2009-0708

Malware in sbrugna...

EUVD-2024-17650

Malicious code in bioql PyPI...

Complaint Management System /user/profile.php File SQL Injection Vulnerability

Complaint Management System is a complaint management system. Complaint Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the /user/profile.php file parameter pincode. An attacker can exploit this...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

Codezips Gym Management System SQL注入漏洞

Codezips Gym Management System is an open source gym management system from Codezips. A SQL injection vulnerability exists in Codezips Gym Management System version 1.0, which stems from the parameter loginid in the file /dashboard/admin/more-userprofile.php that can lead to SQL injection...

CVE-2024-1451

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."...

CVE-2024-53266: Improper Neutralization of Input During Web Page Generation

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to...

CVE-2024-42786

Affected software/version: Kashipara Music Management System v1.0. Component/endpoint: /music/view_user.php (View User Profile Page) vulnerable via the id parameter. Root cause: lack of validation/external SQL input leading to SQL injection. Impact: attacker can execute arbitrary SQL commands, po...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

CVE-2024-37856: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page...

CVE-2024-37856

CVE-2024-37856 : A stored XSS in Lost and Found Information System 1.0 affects the users’ profile fields (first, last, middle name) on the User Profile page, enabling a remote attacker to escalate privileges. The vulnerability is triggered via input into profile name fields and has been demonstra...

CVE-2024-37856

Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page...

Lost And Found Information System 安全漏洞

Lost And Found Information System is a lost and found information system from Lost And Found. A security vulnerability exists in Lost and Found Information System version 1.0, which stems from a cross-site scripting vulnerability that allows a remote attacker to elevate privileges via the first,...

Sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-admin.php of the component Edit User Profile Page. The manipulation of the argument Fullname lea...