CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

EUVD-2025-37489

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL version 1.0 is vulnerable to Cross-Site Scripting (XSS) within the Profile Section . The root cause is the system's failure to properly sanitize user input, which allows an attacker to inject and execute arbitrary JavaScript in a user's browser. No inf...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442: Improper Neutralization of Input During Web Page Generation

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

EUVD-2017-2816

Malware in sbrugna...

EUVD-2019-17091

Malware in sbrugna...

CVE-2025-58174

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

CVE-2025-58174: Improper Neutralization of Input During Web Page Generation

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

GHSA-GJ52-35XM-GXJH Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhpr-465j-7p9q. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account...

CVE-2025-1980 Remote Code Execution via Unrestricted File Upload in Ready_

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

PT-2025-16591

Name of the Vulnerable Software and Affected Versions Ready versions installed at the turn of 2021 and 2022 Description The issue allows users to upload files of any type and extension without restriction in the Profile section of the Ready application. If the server is misconfigured, it can resu...

CVE-2025-1980: Unrestricted Upload of File with Dangerous Type

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

GHSA-VQR3-VRRG-F3JH NodeBB Cross-site scripting (XSS) vulnerability

A persistent cross-site scripting XSS vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile...

CVE-2024-57041

A persistent cross-site scripting XSS vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile...

CVE-2024-57041

NodeBB version 3.11.0 is susceptible to a persistent cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to inject and store arbitrary code within the 'about me' section of a user profile. Successful exploitation enables the execution of malicious scripts on the website. A...

Teachers Record Management System 1.0 - File Upload Type Validation Vulnerability

Exploit Title: Teachers Record Management System 1.0 – File Upload Type Validation Date: 17-01-2023 EXPLOIT-AUTHOR: AFFAN AHMED Vendor Homepage: Software Link: Version: 1.0 Tested on: Windows 11 + XAMPP CVE : CVE-2023-3187 =============================== STEPSTOREPRODUCE...