CVE-2025-13320 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter

The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filterinp...

CVE-2025-13320

CVE-2025-13320 : WP User Manager for WordPress is vulnerable to Authenticated Arbitrary File Deletion via the current_user_avatar parameter in profile updates. The issue arises from insufficient validation of user-supplied file paths and improper handling of array inputs in PHP, enabling attacker...

CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars...

Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81950)

Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...

CVE-2020-14165

The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability...

CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars...

CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars...

Code injection

vBulletin through 5.5.4 mishandles custom avatars...

CVE-2019-17132

CVE-2019-17132 affects vBulletin 5.5.4 and earlier, with a remote code execution via the updateAvatar endpoint from data[extension]/data[filedata] parameters. Several sources document an RCE vulnerability and PoCs/exploits exist; authenticated access is shown in some materials. Impact is high (RC...