PT-2025-9198 · Formwork · Formwork

Name of the Vulnerable Software and Affected Versions: Formwork versions prior to 2.x Description: The issue arises from improper validation of select fields, allowing attackers to craft an input that crashes the system. This impacts the Availability aspect of the CIA triad, although the attack h...

CVE-2025-1687

The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'updateuserprofile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forg...

CVE-2025-1687 Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile

The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'updateuserprofile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forg...

CVE-2025-1687 Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile

The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'updateuserprofile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forg...

WordPress Cardealer theme <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile vulnerability

Cross-Site Request Forgery to User Update via updateuserprofile vulnerability discovered by István Márton in WordPress Theme Car Dealer versions = 1.6.4...

CVE-2024-13873

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto function due to missing validation on a user controlled key. This makes it...

WordPress plugin WP Job Portal 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

GHSA-3HFJ-QCVJ-4HX8 Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

CVE-2024-12276 Ultimate Member <= 2.9.2 - Authenticated SQL Injection

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection via filenames in all versions up to, and including, 2.9.2 due to insufficient escaping on the user supplied parameter...

CVE-2025-24946

creationtimestamp| type| source ---|---|--- 2025-02-20 06:27:36+00:00| seen| https://t.me/cvedetector/18514 2025-02-20 06:41:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3liloowha2s2c 2025-02-20 23:26:53+00:00| seen| Telegram/G3iOGAVpHxFWa5QOLfLOuSM8ve2lou-V2jBz8ywkOjW8Zv2...

CVE-2025-1190

A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /parse/loaduser-profile.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Multiple parameters might be...

Codezips Gym Management System SQL注入漏洞

Codezips Gym Management System is an open source gym management system from Codezips. A SQL injection vulnerability exists in Codezips Gym Management System version 1.0, which stems from the parameter loginid in the file /dashboard/admin/more-userprofile.php that can lead to SQL injection...

CVE-2025-1162

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\parse/load\user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has bee...

PT-2025-6117 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A critical issue has been found in code-projects Job Recruitment. The manipulation of the userhash argument leads to SQL injection. It is possible to initiate the attack remotely. The iss...

CVE-2025-25140

Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...

CVE-2025-25140

Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...

CVE-2025-25140

CVE-2025-25140 : CSRF in WordPress plugin Simple User Profile (versions

CVE-2025-25140 WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...

CVE-2025-25140 WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...