14 matches found
CVE-2026-11977
The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...
EUVD-2026-53288
The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...
CVE-2026-11977: Improper Neutralization of Special Elements used in an SQL Command
The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...
WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin <= 3.9.1 - Authenticated (Author+) SQL Injection vulnerability
Authenticated Author+ SQL Injection vulnerability discovered by Ryoma Nishioka in WordPress Plugin WP Post Author versions = 3.9.1...
CVE-2025-13320 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filterinp...
CVE-2025-13320
CVE-2025-13320 : WP User Manager for WordPress is vulnerable to Authenticated Arbitrary File Deletion via the current_user_avatar parameter in profile updates. The issue arises from insufficient validation of user-supplied file paths and improper handling of array inputs in PHP, enabling attacker...
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars...
Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81950)
Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...
CVE-2020-14165
The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability...
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars...
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars...
Code injection
vBulletin through 5.5.4 mishandles custom avatars...
CVE-2019-17132
CVE-2019-17132 affects vBulletin 5.5.4 and earlier, with a remote code execution via the updateAvatar endpoint from data[extension]/data[filedata] parameters. Several sources document an RCE vulnerability and PoCs/exploits exist; authenticated access is shown in some materials. Impact is high (RC...