Exploit for Unrestricted Upload of File with Dangerous Type in Cozmoslabs Profile_Builder

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthen...

Autodesk: Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile

An Insecure Direct Object Reference IDOR vulnerability was discovered in the Autodesk User Profile. The vulnerability was found in the "id" parameter, which could have allowed an attacker to edit another user's profile...

CERTFR-2022-ALE-011

creationtimestamp| type| source ---|---|--- 2025-01-29 16:46:07+00:00| seen| https://bsky.app/profile/tuxpanik.bsky.social/post/3lgvg7wdge62d...

CERTFR-2022-ALE-006

creationtimestamp| type| source ---|---|--- 2025-01-29 16:43:10+00:00| seen| https://bsky.app/profile/tuxpanik.bsky.social/post/3lgvg2njkuj2d...

CVE-2024-13370 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the saveaddonkeylicense function in all versions up to, and including, 1.3.3. This makes it possible fo...

CVE-2024-10789

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

CVE-2024-10789 WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

CVE-2024-10789

CVE-2024-10789 concerns the WP User Profile Avatar plugin for WordPress. The description reports a CSRF vulnerability in all versions up to 1.0.5 caused by missing or incorrect nonce validation in wpupa_user_admin(), enabling unauthenticated attackers to update plugin settings by luring an admini...

CVE-2024-10789 WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

WordPress plugin WP User Profile Avatar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-40514

Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions...

CVE-2024-40513

CVE-2024-40513 affects themesebrand Chatvia v5.3.2. The vulnerability allows remote attackers to execute arbitrary code via the User profile Upload image function. Public details confirm impact and affected version; however, the exact root cause and exploit details are not provided in the documen...

PT-2025-1606 · WordPress · Wp User Profile Avatar

Name of the Vulnerable Software and Affected Versions: WP User Profile Avatar plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on the wpupa user admin function, making it possible for unauthenticated attackers to upda...

CVE-2024-40513

An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function...

WordPress WP User Profile Avatar plugin <= 1.0.5 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by yudha in WordPress Plugin WP User Profile Avatar versions = 1.0.5...

CVE-2025-22142

CVE-2025-22142 concerns NamelessMC. The vulnerability allows cross-site scripting via an admin-enabled extra field where a user may inject JavaScript that executes when a staff member views the user’s profile on the staff panel. Affected version details are not all consistently stated across sour...

CVE-2024-13310

creationtimestamp| type| source ---|---|--- 2025-01-09 20:34:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113800305263655085 2025-01-09 21:16:39+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfdlzagvme2x 2025-01-09 21:17:29+00:00| seen|...

WordPress User Profile Builder plugin <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Brian Mungah in WordPress Plugin Profile Builder versions = 3.12.9...

CVE-2024-12738

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

CVE-2024-12738 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...