2621 matches found
CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-94152
Omega Solution FBP Fulfillment by People 2025 contains an authorization bypass in the User Profile API (file /user/). The vulnerability is triggered by manipulating the ID argument , allowing a low-privileged remote user to access unauthorized user profiles. The impact is a low confidentiality lo...
EUVD-2026-83866
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...
PT-2026-96055
Name of the Vulnerable Software and Affected Versions Omega Solution FBP Fulfillment by People 2025 Description An authorization bypass exists within the User Profile API component in the /user/ file. Remote exploitation is possible by manipulating the ID argument, allowing an attacker to bypass...
PT-2026-96308
Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description The software fails to validate user identity in the 'PUT /anyone/baseInfo' and 'PUT /anyone/avatar' endpoints. This allows authenticated attackers to modify arbitrary user profiles by supplying...
CVE-2026-94152: Authorization Bypass Through User-Controlled Key
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...
WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.16.1 - Unauthenticated Limited File Upload vulnerability
Unauthenticated Limited File Upload vulnerability discovered by Nir Yehoshua in WordPress Plugin Profile Builder versions = 3.16.1...
CVE-2026-5399
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
CVE-2026-5399
The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...
EUVD-2026-75365
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...
PT-2026-89338
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save function which only sanitizes array values, not scalar...
CVE-2026-19945
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
WordPress User Profile Builder plugin <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability
Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability discovered by daroo in WordPress Plugin Profile Builder versions = 3.15.7...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86489
JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...