CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34621

CVE-2021-34621 affects WordPress ProfilePress plugin versions 3.0.0–3.1.3. The root cause is in RegistrationAuth.php, enabling unauthenticated users to register with administrator privileges, effectively granting full site control. Impact documented as unauthenticated privilege escalation with po...

CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

CVE-2021-34623

The CVE-2021-34623 entry describes an Arbitrary File Upload vulnerability in the Image Uploader component of the ProfilePress WordPress plugin, affecting versions 3.0.0–3.1.3. The issue allows attackers to upload arbitrary files during user registration or profile updates. Connected sources indic...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in WordPress ProfilePress plugin versions 3.0.0 through 3.1.3, whi...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.The WordPress ProfilePress plugin is vulnerable to arbitrary file uploads, which can be exploited...

PT-2021-20590 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress WordPress plugin versions 3.0.0 through 3.1.3 Description: A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file made it possible for users to upload arbitrary files during user...

CVE-2021-34623

A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

The user registration functionality of the plugin allowed arbitrary user meta to be supplied, including wpcapabilities, during registration which made it possible for users to register as an administrator. PoC 'Hax0r', 'regemail' = '[email protected]', 'regpassword' = 'password', 'regpasswordpresen...

GHSA-R578-PJ6F-R4FF Auto-merging Person Records Compromised

Impact New user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages such as giving and events. Patches We have...

Customer Relationship Management System (CRM) 1.0 - Remote Code Execution Exploit

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Customer Relationship Management System (CRM) 1.0 - Remote Code Execution

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Date: 21.06.2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)

Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting XSS Date: 11/06/2021 Exploit Author: BHAVESH KAUL Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on:...

Unspecified Vulnerability in BTCPay Server

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A security vulnerability exists in BTCPay Server versions prior to 1.0.7.1, which stems from incorrectly handling policy settings that allow users to register. No details of th...

PHP-Nuke SQL Injection Vulnerability (CNVD-2021-28375)

PHP-Nuke is a web-based automated news publishing and content management system. A SQL injection vulnerability exists in the "User Registration" section of PHP-Nuke version 8.3.3. An attacker can exploit this vulnerability to achieve remote code execution...

CVE-2021-30177

There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE...