WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR

Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar PoC POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...

WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR

Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...

CVE-2023-31295

CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the User Profile field...

WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP User Profile Avatar Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52118 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ce43b2baade Credits Khalid Yusuf Required privilege...

CVE-2023-7055

A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It i...

PHPGurukul Online Notes Sharing System Cross-Site Request Forgery Vulnerability

PHPGurukul Online Notes Sharing System is an online notes sharing system from PHPGurukul Inc. A cross-site request forgery vulnerability exists in PHPGurukul Online Notes Sharing System version 1.0, which stems from a cross-site request forgery vulnerability in /user/profile.php...

UPM : User profile do not load on VDI or Application launch

User profile does not load on logon andCitrix User Profile Management logs following error. UserIsMemberOfGroup: Group name was not found! Please correct the misconfiguration...

PT-2023-32856 · Unknown · Phpgurukul Online Notes Sharing System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Notes Sharing System version 1.0 Description: A problematic vulnerability has been found in the Contact Information Handler component of the PHPGurukul Online Notes Sharing System. The issue is related to the manipulation of...

Cross site scripting

A vulnerability has been found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file user/profile.php. The manipulation of the argument name/email leads to cross site scripting. The attack can be launche...

CVE-2023-47191 WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a...

PHPGurukul Online Notes Sharing System Security Vulnerability

PHPGurukul Online Notes Sharing System is an online notes sharing system from PHPGurukul Inc. A security vulnerability exists in version 1.0 of the PHPGurukul Online Notes Sharing System, which originates from a cross-site scripting XSS vulnerability in the file user/profile.php...

CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the...

CVE-2023-44150

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login...

CVE-2023-44150

CVE-2023-44150 affects ProfilePress (Paid Membership Plugin) for WordPress; versions

UPM - Microsoft Edge browser does not retain saved credentials in subsequent logins

With Citrix User Profile Management UPM configuration Microsoft Edge browser does not retain saved credentials in subsequent login to VDI...

User profile settings are not saved with WEM

User profile saved settings are not saved. UPM or WEM settings are missing in the registry key locations following = HKLM/Software/Policies/Citrix/UserProfileManager HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\UsvMachineConfigurationSettings...

CVE-2023-47669

Cross-Site Request Forgery CSRF vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin = 3.10.3 versions...

CVE-2023-47669

Cross-Site Request Forgery CSRF vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin = 3.10.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin = 3.10.3 versions...

CVE-2023-47669

CVE-2023-47669 is a CSRF vulnerability in the WordPress plugin “User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor” by Cozmoslabs, affecting versions prior to 3.10.3. The issue allows cross-site request forgery without authentication (per Patchstack/CVE rec...