1613 matches found
CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload
Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...
CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload
Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...
PT-2024-13407 · Django +1 · Django +1
Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.9.2 Description: The issue is a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the...
CVE-2023-6384
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
Design/Logic Flaw
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384
CVE-2023-6384 affects the WP User Profile Avatar WordPress plugin, vulnerable in versions before 1.0.1. The issue is an authorization/IDOR flaw that lets authors delete or update arbitrary avatars due to improper access checks. Impact is limited to avatar management (not full site compromise) as ...
WordPress plugin WP User Profile Avatar security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...
CVE-2024-0185
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
CVE-2024-0185 RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
CVE-2024-0185 RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboardteacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely...
CVE-2024-0185
CVE-2024-0185 concerns RRJ Nueva Ecija Engineer Online Portal v1.0. The vulnerability affects the Avatar Handler’s dasboard_teacher.php, where manipulation enables unrestricted file uploads. Exploitation is described as remote and publicly disclosed. Affected product is RRJ Nueva Ecija Engineer O...
PT-2024-15369 · Unknown · Rrj Nueva Ecija Engineer Online Portal
Name of the Vulnerable Software and Affected Versions: RRJ Nueva Ecija Engineer Online Portal version 1.0 Description: A critical issue affects the processing of the file dasboard teacher.php of the component Avatar Handler, leading to unrestricted upload. The attack may be initiated remotely...
PT-2023-32914 · Unknown · Gopeak Masterlab
Name of the Vulnerable Software and Affected Versions: gopeak MasterLab versions up to 3.3.10 Description: A critical issue has been found in the function add/update of the file app/ctrl/admin/User.php, where the manipulation of the avatar argument leads to unrestricted upload. This issue can be...
WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar PoC POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...
WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
Description The plugin does not properly check for authorisation, allowing authors to delete and update arbitrary avatar POC request: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: yoursite User-Agent: Mozilla/5.0 X11; Linux aarch64; rv:102.0 Gecko/20100101 Firefox/102.0 Accept:...
WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software WP User Profile Avatar Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52118 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ce43b2baade Credits Khalid Yusuf Required privilege...
