Design/Logic Flaw

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577

ProcessMaker before v3.5.4 has an insecure permission issue on the user profile page that lets normal users escalate to Administrators. This is documented across multiple sources (NVD/Red Hat/OSV) and is the same CVE entry, CVE-2022-38577. The Red Hat data additionally notes a related unrestricte...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

ProcessMaker 权限许可和访问控制问题漏洞

ProcessMaker is a Php-written website builder for business process management BPM and workflow management from ProcessMaker Inc. in the United States. A security vulnerability exists in ProcessMaker prior to version v3.5.4, which stems from an insecure privilege in its user profile page that allo...

Description of the security update for SharePoint Server Subscription Edition Language Pack: September 13, 2022 (KB5002270)

None None...

Nextcloud: Profile of disabled user stays accessible

Userprofiles of disabled users keep staying accessible. on DOMAIN/u/USERID This is quite undesirable as this user has no way to clear or modify this data in case they do not want it exposed anymore. I'd assume profiles of disabled users would not be visible to ensure they can always be in control...

Cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Hall Booking System. This affects an unknown part of the file /whbs/admin/?page=user of the component Staff User Profile. The manipulation of the argument First Name/Last Name leads to cross site scripting. ...

CVE-2022-2692 SourceCodester Wedding Hall Booking System Staff User Profile cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Hall Booking System. This affects an unknown part of the file /whbs/admin/?page=user of the component Staff User Profile. The manipulation of the argument First Name/Last Name leads to cross site scripting. ...

CVE-2022-2692 SourceCodester Wedding Hall Booking System Staff User Profile cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Hall Booking System. This affects an unknown part of the file /whbs/admin/?page=user of the component Staff User Profile. The manipulation of the argument First Name/Last Name leads to cross site scripting. ...

CVE-2022-36284

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin = 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin free should be at least installed to get the extra input field on the user profile page...

CVE-2022-36284

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin = 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin free should be at least installed to get the extra input field on the user profile page...

DNN (DotNetNuke) <= 9.10.2 XSS Vulnerability

DNN formerly DotNetNuke is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-31858

DotNetNuke DNN 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload...

CVE-2021-31858

DotNetNuke DNN 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload...

Cross site scripting

DotNetNuke DNN 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload...

CVE-2021-31858

DotNetNuke DNN 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload...

CVE-2021-31858

CVE-2021-31858 affects DotNetNuke (DNN) 9.9.1 CMS. The issue is a stored XSS in the user profile biography section that allows remote authenticated users to inject arbitrary code via a crafted payload. CVSSv3.1/base score 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Exploitation details are not pro...

Employee Leaves Management System Cross-Site Request Forgery Vulnerability

Employee Leaves Management System ELMS is an internal employee management system. A cross-site request forgery vulnerability exists in Employee Leaves Management System ELMS v2.1, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc...

Tourism Management System Cross-Site Request Forgery Vulnerability

Tourism Management System is a website builder for tourism management. A cross-site request forgery vulnerability exists in Tourism Management System v3.2, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc. The vulnerability is...

Tourism Management System 跨站请求伪造漏洞

Tourism Management System is a website builder for tourism management. A cross-site request forgery vulnerability exists in Tourism Management System v3.2, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc. The vulnerability is...