PYSEC-2024-296

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web...

PYSEC-2024-296

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web...

PT-2024-21296 · Opencti · Opencti

Name of the Vulnerable Software and Affected Versions: OpenCTI affected versions not specified Description: The issue is related to a lack of certain security controls on the profile edit functionality in OpenCTI, allowing an authenticated attacker with low privileges to gain administrative...

Prison Management System 跨站脚本漏洞

Prison Management System is a prison management system developed by Carlo Montero. A cross-site scripting vulnerability exists in Prison Management System version 1.0, which originates in /Employee/edit-profile.php and contains unknown code that causes cross-site scripting through the use of the...

OpenPNE opTimelinePlugin Security Vulnerability

OpenPNE is OpenPNE is SNS builder software developed by an open source approach led by Teshimaya. A security vulnerability exists in OpenPNE opTimelinePlugin 1.2.11 and earlier versions, which stems from a stored cross-site scripting XSS vulnerability in the Edit Profile page...

CVE-2023-52060

A Cross-Site Request Forgery CSRF in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request...

CVE-2023-52060

A Cross-Site Request Forgery CSRF in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request...

CVE-2023-52060

A Cross-Site Request Forgery CSRF in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request...

GESTSUP Security Vulnerabilities

GESTSUP is a software application from the French company GESTSUP. It is 100% web-based SUPport MANAGEMENT software that manages tickets and devices. A security vulnerability exists in GESTSUP version v3.2.46, which stems from the presence of a cross-site request forgery CSRF vulnerability that...

CVE-2024-1008

A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipulation leads to unrestricted upload. The attack can be...

CVE-2023-6410

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retriev...

PT-2023-12455 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to missing login checks on the stm listing profile edit AJAX action, allowing unauthenticated attackers to edit any account on the blog. This...

WordPress Plugin uListing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-29523

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...

CVE-2023-29514

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document e.g., their own user profile can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki...

CVE-2023-29514

XWiki Platform is affected by a Code Injection vulnerability in the template provider administration (CVE-2023-29514). Any user with edit rights on a document can execute code with programming rights, enabling remote code execution. Red Hat, OSV, CVE listings and OpenVAS/third-party advisories co...

PT-2023-22301 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.2 XWiki Platform versions prior to 15.0RC1 Description: The issue allows any user who can edit their own user profile to...

CVE-2022-2273

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

CVE-2022-2273

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

Library Management System With QR Code 1.0 Cross Site Scripting Vulnerability

Title: Library Management System with QR code Attendance 1.0 Stored Cross-Site Scripting Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...