unve1ler

Revealing Digital Footprints and Visual Clues on the Internet. A social engineering tool designed to seamlessly locate profiles using usernames while offering convenient reverse image search functionality. This tool is a Proof of Concept and is for Educational Purposes Only. unve1ler is a potent...

CVE-2026-104995

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

CVE-2026-104995

The BP Profile Search plugin for WordPress (versions up to and including 5.9 ) is vulnerable to Local File Inclusion (LFI) leading to Remote Code Execution (RCE) . The root cause lies in the bps_directory_ajax() filter, which parses the ajax_template value from the attacker-controlled bps_directo...

CVE-2026-104995 BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

EUVD-2026-100768

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

CVE-2026-104995: Improper Control of Filename for Include/Require Statement in PHP Program

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

PT-2026-113593

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax template' value parsed from the client-controlled 'bps directory' cookie during BuddyPress AJAX directory requests. The bps directory ajax filter hooked onto bp...

WordPress BP Profile Search plugin <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability

Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by snr in WordPress Plugin BP Profile Search versions = 5.9...

NetBT Consulting Services E-Fatura code issue vulnerability

NetBT Consulting Services E-Fatura is an enterprise financial software from NetBT Consulting Services, Turkey. A code issue vulnerability exists in NetBT Consulting Services E-Fatura versions prior to 1.2.15, which stems from an un-referenced search path or element that could lead to the...

EUVD-2024-19854

Malicious code in bioql PyPI...

CVE-2024-22293

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5...

CVE-2024-7850

The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bpsajaxfieldselector, bpsajaxtemplateoptions, and bpsajaxfieldrow functions. This makes it possible for...

WordPress BP Profile Search plugin <= 5.7.5 - Cross-Site Request Forgery to Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin BP Profile Search versions = 5.7.5...

CVE-2024-7850: Cross-Site Request Forgery (CSRF)

The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bpsajaxfieldselector, bpsajaxtemplateoptions, and bpsajaxfieldrow functions. This makes it possible for...

WordPress BP Profile Search Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software BP Profile Search Type Plugin Vulnerable versions = 5.7.5 Fixed in 5.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7850 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID c231ea7c4aad Credits vgo0 Required...

WordPress plugin BP Profile Search has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-38627

Name of the Vulnerable Software and Affected Versions BP Profile Search plugin for WordPress versions up to, and including, 5.7.5 Description The issue is due to missing or incorrect nonce validation on the bps ajax field selector, bps ajax template options, and bps ajax field row functions. This...

CVE-2024-22293

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5...

CVE-2024-22293 WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5...