CVE-2024-10557

受影响版本： 血液银行管理系统 ：1.0 漏洞信息： 漏洞类型： 跨站请求伪造（CSRF） 严重性： 高 状态： 未修补 脆弱端点： 路径： /file/updateprofile.php 漏洞描述： 端点 /file/updateprofile.php 存在一个CSRF漏洞，允许远程用户更新医院用户的详细信息，并可能导致账户接管，因为攻击者可以更新从电子邮件到密码的所有信息，从而有效增加账户接管的机会。 成功利用可能导致代表受害者执行未授权操作，例如删除数据 。此外，受害者访问带有payload的恶意网站也可触发此漏洞。 概念验证（PoC）： 下面是一个CSRF POC攻击...

CVE-2026-83743

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2025-14221

描述 1. CVE-2025-14221 2. 发现者：Fatma Trabelsi 3. 产品供应商：SourceCodester 4. 受影响产品：Online Banking System 1.0 POC 在应用程序的用户资料更新功能中存在一个存储型跨站脚本（XSS）漏洞。应用程序未能正确清理用户在“名字”字段中提供的输入，就将其存储到数据库中并在多个页面上渲染。...

CVE-2026-83743

Invoice Ninja versions up to 5.13.26 are affected by an authorization bypass in the Vendor Portal Profile Update component (file /vendor/profile/). By manipulating the vendor_contact argument, a remotely authenticated user (low privileges) can bypass access controls, resulting in low impact on co...

CVE-2026-83743 invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2026-82622 code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting

A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be...

EUVD-2026-68365

A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be...

roller-csrf

Apache Roller v6.1.2 - 配置文件更新中的跨站请求伪造 CSRF 漏洞详情 版本 : v6.1.2 日期 : 2025-11-09 漏洞发现者 : Van Lam Nguyen Facebook : https://www.facebook.com/vanlam1412 厂商主页 : https://roller.apache.org 软件链接 : https://github.com/apache/roller/archive/refs/tags/roller-6.1.2.zip 测试环境 : Windows CVE : 无 演示 :...

EUVD-2026-68042

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...

CVE-2026-64962

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

EUVD-2026-63362

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

CVE-2026-64962

ATutor's profile update functionality lacks CSRF token validation, allowing an attacker to craft a malicious site that submits forged profile-modification requests when visited by an authenticated victim. CVSS 5.1 (Medium), network attack vector. ATutor is end-of-life; no fix exists—upgrade to a ...

CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass

Description WordPress does not always validate a new email address consistently when a profile is updated, which could allow any authenticated user to change their account email address without completing the ownership confirmation step...

CVE-2026-65603

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

EUVD-2026-47647

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-65603

Summary: Grav Login Plugin for Grav (grav-plugin-login)

PT-2026-63361

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the update user task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from...