Sql injection

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dlprint.php when registering ordinary users...

CVE-2021-40281

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dlprint.php when registering ordinary users...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China. A SQL injection vulnerability exists in ZZCMS, which stems from a lack of validation of externally entered SQL statements when registering regular users in dl/dldownload.php. An attacker could use this vulnerability to execute...

Authentication Bypass Vulnerability Patched in User Registration Plugin

Note: To receive disclosures like this in your inbox the moment they’re published, you can subscribe to our WordPress Security Mailing List. On September 16, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in...

SQL Injection

b2evolution is vulnerable to sql injection. An attacker can inject and execute malicious input through the user input parameters in the user registration section of register.php...

Online Enrollment Management System in PHP and PayPal 1.0 - (U_NAME) Stored XSS Vulnerability

Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'UNAME' Stored Cross-Site Scripting Exploit Author: Tushar Jadhav Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting

Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'UNAME' Stored Cross-Site Scripting Date: 2021-08-31 Exploit Author: Tushar Jadhav Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset

The plugin has two AJAX actions, mepwlajaxlicenseactivate and mepwlajaxlicensedeactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result,...

CVE-2021-25973

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

CVE-2020-23051

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...

Cross site scripting

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...

CVE-2020-23051

CVE-2020-23051 involves Phpgurukul User Registration & User Management System v2.0 with multiple stored cross-site scripting (XSS) vulnerabilities. The flaws are exploitable via the firstname and lastname parameters of the registration form and the loginsystem input fields. The public documents i...

CVE-2020-23051

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...

Phpgurukul User Registration Login Management System 跨站脚本漏洞

Phpgurukul User Registration Login Management System is a website builder for user management from the PHPGurukul Phpgurukul team. A security vulnerability exists in Phpgurukul User Registration and User Management System version 2.0, which allows an attacker to exploit a cross-site scripting...

WordPress plugin User Registration cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers.The WordPress plugin User Registration has a cross-site scripting vulnerability that stems from the lack of proper validation ...

CVE-2021-24654

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attack...

CVE-2021-24654

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attack...

CVE-2021-24654

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attack...

Cross site scripting

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attack...

CVE-2021-24654

CVE-2021-24654 affects the WordPress plugin User Registration (before 2.0.2). The vulnerability arises because user_registration_profile_pic_url is not properly sanitised when submitted via the user_registration_update_profile_details AJAX action, allowing any authenticated user (e.g., a subscrib...