2634 matches found
CVE-2025-0589: Incorrect Use of Privileged APIs
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly...
CVE-2025-1162
A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\parse/load\user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has bee...
PT-2025-6117 · Unknown · Code-Projects Job Recruitment
Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A critical issue has been found in code-projects Job Recruitment. The manipulation of the userhash argument leads to SQL injection. It is possible to initiate the attack remotely. The iss...
CVE-2025-25140
Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...
CVE-2025-25140
Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...
CVE-2025-25140
CVE-2025-25140 : CSRF in WordPress plugin Simple User Profile (versions
CVE-2025-25140 WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...
CVE-2025-25140 WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...
CVE-2025-25140: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through = 1.9...
WordPress plugin Simple User Profile 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2022-41930
org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user logged in or not with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attack...
CVE-2022-41976
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change role e.g., to administrator by updating their user profile...
CVE-2024-1451
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."...
CVE-2024-54358
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through = 1.0.0...
CVE-2024-0324
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppbtwofactorauthenticationsettingsupdate' function in all versions up to, and including...
CVE-2024-53266: Improper Neutralization of Input During Web Page Generation
Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to...
WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Simple User Profile versions = 1.9...
Exploit for Unrestricted Upload of File with Dangerous Type in Cozmoslabs Profile_Builder
CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthen...
Autodesk: Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile
An Insecure Direct Object Reference IDOR vulnerability was discovered in the Autodesk User Profile. The vulnerability was found in the "id" parameter, which could have allowed an attacker to edit another user's profile...
