Student Enrollment 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Student Enrollment v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

SolarWinds Serv-U 15.2.0 < 15.2.3

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.2 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u1522hf1 advisory. - In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users'...

User Profile hangs when using CVAD 2203 CU5

Upgrading to CVAD 2203 CU5 found an issue with hanging on loading the user profile. It eventually times out and the session is disconnected/hung...

WordPress plugin MStore API 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-15105 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 24 Description: A denial of service issue was found in Keycloak where the amount of attributes per object is not limited. An attacker could cause resource exhaustion by sending repeated HTTP requests, leading to the...

U.S. Dept Of Defense: CSRF leads to Account takeover

The CSRF vulnerability was found on the endpoint https://██████████/account/profile/edit, which allowed an attacker to modify the victim's account information, including their username, password, and email address, resulting in account takeover...

PPDB 2.4-update 6118-1 Cross Site Request Forgery

============================================================================================================================================= | Title : ppdb v2.4-update 6118-1 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | ...

CVE-2024-8366

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?id=userProfileEdit of the component Update My Profile Page. The manipulation of the argument fname/lname/email with the input alert...

PT-2024-38971 · Code Projects · Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A vulnerability was found in the Update My Profile Page component of the Pharmacy Management System. The issue affects an unknown part of the file /index.php?id=userProfileEdit...

CVE-2024-43336 WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through = 2.9.10...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

CVE-2024-42786

Affected software/version: Kashipara Music Management System v1.0. Component/endpoint: /music/view_user.php (View User Profile Page) vulnerable via the id parameter. Root cause: lack of validation/external SQL input leading to SQL injection. Impact: attacker can execute arbitrary SQL commands, po...

CVE-2024-42786

A SQL injection vulnerability in "/music/viewuser.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page...

The vulnerability of the User Profile Handler component on the Apache Roller server for creating web blogs allows attackers to execute XSS attacks.

The vulnerability of the User Profile Handler component on the Apache Roller web blog server exists due to the lack of security measures for handling web page structures. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-40531

A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions...

CVE-2024-40531

A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions...

UAB Pantera CRM 安全漏洞

UAB Pantera CRM is a tool and information management system from UAB Pantera. A security vulnerability exists in UAB Pantera CRM versions v.401.152 and v.402.072, which originated from a vulnerability that allows remote attackers to elevate privileges via the user profile management feature...

CVE-2024-40531

A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions...