CVE-2025-55854-PoC

CVE-2025-55854 - 保存型クロスサイトスクリプティング（XSS）の脆弱性 脆弱性の概要 CVE ID: CVE-2025-55854 脆弱性の種類: 保存型クロスサイトスクリプティング（XSS） 深刻度: 高 影響を受けるコンポーネント: ユーザープロフィールのBioフィールド 影響を受けるアプリケーション: FreelanceHub https://github.com/nooncarlett/FreelanceHub 説明...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ 그런 다음 해당 작성자가 작성한 게시물을 조회하면 XSS가 트리거됩니다. 동영상 PoC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2026-54506

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: A bug has been fixed if the bio field exceeds its limit. If dmintegritychecklimits fails, the code will exit with DMMAPIOKILL. However, the range would already be locked at this point, and it would not be unlocked,...

CVE-2021-47934

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php...

CVE-2021-47934

MyBB Timeline Plugin 1.0 is affected by cross-site scripting (XSS) in thread titles, post content, and user profile fields (Location, Bio). A cross-site request forgery (CSRF) in the timeline.php profile action can be exploited to change a user’s cover picture via malicious forms that execute whe...

CVE-2021-47934

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php...

PT-2026-41448

Name of the Vulnerable Software and Affected Versions MyBB Timeline Plugin version 1.0 Description Cross-site scripting issues allow the injection of malicious scripts via thread titles, post content, and user profile fields such as Location and Bio. Additionally, a cross-site request forgery fla...

CVE-2026-32099 Discourse prevents hidden profile data leak via user onebox

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has hideprofile enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's...

CVE-2023-53301

CVE-2023-53301 affects the Linux kernel f2fs subsystem. The root cause is a NULL pointer dereference when io->bio is NULL inside __submit_merged_write_cond, which can cause a kernel panic during f2fs_checkpoint/write paths. A fix was implemented to return when io->bio is NULL before proceed...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

CVE-2018-7663: Improper Neutralization of Input During Web Page Generation

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

PT-2018-18194

Name of the Vulnerable Software and Affected Versions Voten.co versions prior to 2017-08-25 Description An issue was discovered in the bio field of a user profile, allowing for server-side template injection of arbitrary JavaScript due to an unescaped template literal in...