CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ その後、その作成者が作成した投稿を表示してXSSをトリガーします。 動画POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2025-55854-PoC

CVE-2025-55854 - 存储型跨站脚本（XSS）漏洞 漏洞概述 CVE ID： CVE-2025-55854 漏洞类型： 存储型跨站脚本（XSS） 严重程度： 高危 受影响组件： 用户个人资料简介字段 受影响应用： FreelanceHub https://github.com/nooncarlett/FreelanceHub 描述 在 FreelanceHub 应用的用户个人资料功能中发现了一个存储型跨站脚本（XSS）漏洞。该漏洞源于 Bio 字段的输入清理不足，允许攻击者注入恶意 JavaScript 代码，当其他用户查看受影响的个人资料页面时，该代码会执行。...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: A bug has been fixed if the bio field exceeds its limit. If dmintegritychecklimits fails, the code will exit with DMMAPIOKILL. However, the range would already be locked at this point, and it would not be unlocked,...

CVE-2021-47934

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php...

CVE-2021-47934

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php...

CVE-2021-47934

MyBB Timeline Plugin 1.0 is affected by cross-site scripting (XSS) in thread titles, post content, and user profile fields (Location, Bio). A cross-site request forgery (CSRF) in the timeline.php profile action can be exploited to change a user’s cover picture via malicious forms that execute whe...

PT-2026-41448

Name of the Vulnerable Software and Affected Versions MyBB Timeline Plugin version 1.0 Description Cross-site scripting issues allow the injection of malicious scripts via thread titles, post content, and user profile fields such as Location and Bio. Additionally, a cross-site request forgery fla...

CVE-2026-32099 Discourse prevents hidden profile data leak via user onebox

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has hideprofile enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's...

CVE-2023-53301

CVE-2023-53301 affects the Linux kernel f2fs subsystem. The root cause is a NULL pointer dereference when io->bio is NULL inside __submit_merged_write_cond, which can cause a kernel panic during f2fs_checkpoint/write paths. A fix was implemented to return when io->bio is NULL before proceed...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...