CVE-2021-24450

The User Registration, User Profiles, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript...

CVE-2020-26415

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab =12.2 to =13.5 to =13.6 to 13.6.2...

CVE-2019-9377

In FingerprintService, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check. This could lead to a local information disclosure of metadata about the biometrics of another user on the device with no additional...

CVE-2025-1418 Information disclosure in Proget MDM

A low-privileged user can access information about profiles created in Proget MDM Mobile Device Management, which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information including their usage in connected devices. This issue has been fixed...

DNS Query Forgery: a Client-Side Defense against Mobile App Traffic Profiling

Mobile applications continuously generate DNS queries that can reveal sensitive user behavioral patterns even when communications are encrypted. This paper presents a privacy enhancement framework based on query forgery to protect users against profiling attempts that leverage these background...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20966

CVE-2025-20966 affects Samsung Gallery; vulnerable is improper access control in versions: Global Android 13 ≤ 14.5.10.3, China Android 13 ≤ 14.5.09.3, and Android 14 ≤ 15.5.04.5. Root cause: improper access control enabling cross-profile data access by physical attackers. Impact: exposure of dat...

PT-2025-20051 · Samsung · Samsung Gallery

Name of the Vulnerable Software and Affected Versions: Samsung Gallery versions prior to 14.5.10.3 in Global Android 13 Samsung Gallery version 14.5.09.3 in China Android 13 Samsung Gallery version 15.5.04.5 in Android 14 Description: The issue is related to improper access control in Samsung...

CVE-2025-24132

creationtimestamp| type| source ---|---|--- 2025-04-29 14:21:44+00:00| seen| https://bsky.app/profile/dysternis.bsky.social/post/3lnxi4jp6lc2g 2025-04-29 22:16:51+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/34679 2025-04-29 22:33:24+00:00| published-proof-of-concept|...

CVE-2025-25777

Insecure Direct Object Reference IDOR in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks...

CVE-2025-25777

Insecure Direct Object Reference IDOR in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks...

CVE-2025-25777

Insecure Direct Object Reference IDOR in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks...

CVE-2025-31524

Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through = 2.6.2...

CVE-2025-31524

Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through = 2.6.2...

CVE-2025-31524

CVE-2025-31524 – WP User Profiles privilege escalation : Affected WP User Profiles (

CVE-2025-31524 WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through = 2.6.2...

PT-2025-15926 · WordPress · Wp User Profiles

Name of the Vulnerable Software and Affected Versions: WP User Profiles versions n/a through 2.6.2 Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in NotFound WP User Profiles. Recommendations: For versions n/a through 2.6.2,...