CVE-2026-102121

The Kiteworks Secure Data Forms product contains a vulnerability in its Advanced Forms component where the form-rendering interface is reachable without authentication. While published forms are intended for anonymous visitors, the interface returns excessive data beyond what is required for the ...

CVE-2026-31016: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint...

CVE-2026-31016

Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint...

CVE-2026-31016

Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint...

CVE-2026-31016

Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint...

CVE-2025-71337 Flowise - Unverified Email Change via Account Profile Endpoint

Flowise before 3.0.10 affected versions 3.0.7 and earlier contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the...

CVE-2025-71337: Unverified Password Change

Flowise before 3.0.10 affected versions 3.0.7 and earlier contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the...

EUVD-2024-2868

Malicious code in bioql PyPI...

CVE-2025-2637

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The...

CVE-2025-2637 JIZHICMS Account Profile Page userinfo.html improper authorization

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The...

CVE-2025-2637 JIZHICMS Account Profile Page userinfo.html improper authorization

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The...

CVE-2025-2637

CVE-2025-2637 affects JIZHICMS up to version 1.7.0. Affected is the file /user/userinfo.html in the Account Profile Page, where manipulation of the parameter jifen leads to improper authorization. The issue is exploitable remotely and the exploit has been disclosed publicly. Multiple sources corr...

PT-2025-12504 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: JIZHICMS version 1.7.0 Description: A vulnerability has been found in JIZHICMS, affecting some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the jifen argument leads to improp...

CVE-2025-2637: Improper Authorization

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The...

GHSA-RW3J-574H-MRCQ IDOR vulnerability in account profile page

Impact Insecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer...

IDOR vulnerability in account profile page

Impact Insecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer...

Authorization Bypass Through User-Controlled Key

Overview aimeos/ai-controller-frontend is an Aimeos business controller logic for frontend Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the account profile page. An attacker can manipulate account details and disable subscriptions an...

CVE-2023-26689

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request...

CVE-2022-22002: Undefined Security Weakness

Windows User Account Profile Picture Denial of Service Vulnerability...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Remote code execution Administrator/Root rights Remote code execution User rights...