CVE-2019-19551

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

CVE-2012-1019

Multiple cross-site scripting XSS vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 XWiki.XWikiCommentscomment parameter to xwiki/bin/commentadd/Main/WebHome, 2 XWiki.XWikiUsers0company parameter when editing a user profile, or 3...

PT-2025-22527 · Unknown · Group-Office

Name of the Vulnerable Software and Affected Versions: Group-Office versions prior to 6.8.119 and 25.0.20 Description: A stored and blind XSS issue exists in the Phone Number field of the user profile within the Group-Office application. This allows a malicious actor to inject persistent JavaScri...

Daily Expense Tracker System SQL Injection Vulnerability (CNVD-2025-31002)

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. Daily Expense Tracker System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter fullname/contactnumber in the file...

CVE-2025-48340

Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through = 1.02...

CVE-2008-0180

Cross-site scripting XSS vulnerability in themes/unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile...

CVE-2025-48340

Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through = 1.02...

CVE-2025-48340 WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through 1.02...

CVE-2025-48340

CVE-2025-48340 refers to a CSRF to Privilege Escalation vulnerability in WordPress plugin User Profile Meta Manager (Danny Vink), affecting versions 1.02 and earlier. The issue enables privilege escalation through CSRF; no exploitation details are provided in the sources. Remediation guidance fro...

CVE-2025-48340: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through = 1.02...

CVE-2025-4785

CVE-2025-4785 affects PHPGurukul Daily Expense Tracker System version 1.1. The vulnerability is a SQL injection in the file /user-profile.php triggered by manipulating the fullname and contactnumber parameters, with remote exploit potential. Multiple connected sources confirm the issue and indica...

PHPGurukul Daily Expense Tracker System 安全漏洞

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. Daily Expense Tracker System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter fullname/contactnumber in the file...

CVE-2024-6708

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

CVE-2024-6708 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

CVE-2024-6708 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

CVE-2024-6708

The User Profile Builder WordPress plugin, in versions prior to 3.12.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitise and escape certain parameters before displaying their content within the admin area . This flaw allows users wi...

PT-2025-21490 · WordPress · User Profile Builder

Name of the Vulnerable Software and Affected Versions: The User Profile Builder WordPress plugin versions prior to 3.12.2 Description: The issue allows Admin+ users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters before outputting its...

WordPress plugin User Profile Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-6708: Improper Neutralization of Input During Web Page Generation

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

The vulnerability of the _parse/load_user-profile.php file in the Job Recruitment system allows a hacker to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the parse/loaduser-profile.php file in the Job Recruitment system is related to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information and execute arbitra...