338 matches found
DRUPAL-CONTRIB-2021-044
This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This...
OpenID Connect Microsoft Azure Active Directory client - Moderately critical - Access Bypass - SA-CONTRIB-2021-044
This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This...
CVE-2021-34622
A vulnerability in the user profile update component found in the /src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3...
CVE-2021-34622
ProfilePress for WordPress (plugin) versions 3.0.0–3.1.3 contain a privilege-escalation flaw in the user profile update flow (EditUserProfile.php) that allows authenticated users to elevate to administrator by supplying arbitrary usermeta (notably wp_capabilities). Affected products: ProfilePress...
EUVD-2021-21272
A vulnerability in the user profile update component found in the /src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3...
ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation
The user profile update functionality of the plugin allowed arbitrary user meta to be supplied, including wpcapabilities, during a profile update which made it possible for users to escalate their privileges to that of an an administrator. PoC 'Hax0r3', 'regemail' = '[email protected]',...
Nextcloud: [nextcloud.com] Control character allowed in Submit Question
Issue descriptions We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains...
CVE-2020-36156
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...
CVE-2020-36156
CVE-2020-36156 affects the WordPress plugin Ultimate Member (before 2.1.12). The vulnerability allows an authenticated user with wp-admin access to profile.php to supply the parameter um-role with a value (e.g., Administrator) during a profile update, escalating privileges. Documented impact is P...
Rock RMS Security Vulnerability
Rock RMS is a church management system. Versions of Rock RMS prior to 8.6 have a security vulnerability. An attacker could easily take over an account by tampering with the user id parameter in the profile update. Due to the lack of authentication and the use of consecutive user ids, any user can...
CVE-2020-35935
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aamuserroles POST parameter if Multiple Role support is enabled. The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios...
Content Management System 1.0 - 'First Name' Stored XSS
Exploit Title:Content Management System 1.0 - 'First Name' Stored XSS Exploit Author: Zhayi Zeo Date: 2020-12-14 Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html Software Link:...
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update
Due to the fact that Ultimate Member allowed the creation of new roles, this plugin also made it possible for site administrators to grant secondary Ultimate Member roles for all users upon a /wp-admin profile update. PoC $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In',...
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update
Due to the fact that Ultimate Member allowed the creation of new roles, this plugin also made it possible for site administrators to grant secondary Ultimate Member roles for all users upon a /wp-admin profile update. $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In', ;...
qdPM 9.1 - Arbitrary File Upload
Exploit Title: qdPM 9.1 - Arbitrary File Upload Date: 2020-05-06 Author: Besim ALTINOK Vendor Homepage: https://sourceforge.net/projects/qdpm/ Software Link: https://sourceforge.net/projects/qdpm/ Version: v9.1 Maybe it affect other versions Tested on: Xampp Credit: İsmail BOZKURT Remotely: Yes...
School ERP Pro 1.0 Remote Code Execution
Exploit Title: School ERP Pro 1.0 - Remote Code Execution Date: 2020-04-28 Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKURT Description...
PHP Scripts Mall Chartered Accountant:Auditor Website Cross-Site Scripting Vulnerability
PHP Scripts Mall Chartered Accountant:Auditor Website is an accounting auditor website system script from PHP Scripts Mall, India. A cross-site scripting vulnerability exists in the Profile Update page in PHP Scripts Mall Chartered Accountant : Auditor Website version 2.0.1, which can be exploite...
CVE-2019-7553
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...
