CVE-2022-42098

KLiK-SocialMediaWebsite 版本 v1.0.1 漏洞说明： KLiK-SocialMediaWebsite v1.0.1 在 profile.php 的 id 参数存在 SQL 注入漏洞。 攻击向量： KLiK-SocialMediaWebsite v1.0.1 一旦创建用户，也可以通过 KLiK 用户页面在 KLiK 上查找人员。profile.php 的 'id' 参数可被滥用，用于注入任意 SQL 查询。 受影响： http://ipaddress/KLiK/profile.php?id=userid GET /KLiK/login.php Payload：...

CVE-2021-24545

CVE-2021-24545 目前该插件已停止分发，是在该插件中发现的XSS漏洞。 WordPress Plugin HTML Author Bio description XSS 该漏洞是由于 /wp-admin/profile.php 中 description 参数的不当验证引起的。 远程攻击者可以通过发送恶意构造的HTTP请求进行攻击。 安装及运行步骤 1. WordPress 安装 进行安装时，请在 docker-compose.yml 文件中进行端口转发。 $ docker-compose up 2. WordPress initial & Plugin...

CVE-2020-24913-PoC

CVE-2020-24913-PoC CVE-2020-24913 的 PoC，存在于 qcubed（所有版本，包括 3.1.1）中的 SQL 注入漏洞，位于 profile.php，通过 strQuery 参数，允许未经身份验证的攻击者通过精心构造的 POST 请求注入 SQL 代码来访问数据库。此 PoC 使用 MySQL 数据库执行。我们无法使用堆叠查询负载（如同 PostgreSQL 那样），因此必须通过基于时间的方法来利用此漏洞。 载荷 在 "strProfileData" 参数中，我们使用以下载荷（未编码）：...

CVE-2022-28986

CVE-2022-28986 LMS Doctor 的 "Simple 2FA Plugin for Moodle" 中存在不安全的直接对象引用（IDOR）漏洞 漏洞详情 风险等级：严重 厂商：LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle 披露者：Flaviu Popescu 描述： LMS Doctor 的 Moodle 简易双因素认证插件中存在不安全的直接对象引用（IDOR）漏洞。允许远程攻击者更新其他用户账户的敏感记录，如电子邮件、密码和电话号码。 验证概念：...

CVE-2006-0450-phpBB-2.0.15-Multiple-DoS-Vulnerabilities

Neo Security Team NST® - 公告 15 - 00/00/06 程序: phpBB 2.0.15 主页: http://www.phpbb.com 受影响版本: phpBB 2.0.15 及更低版本 风险: 高风险!! 影响: 多个拒绝服务漏洞。 描述 phpBB 是一个功能强大、完全可扩展且高度可定制的 开源论坛软件包。phpBB 拥有用户友好的 界面、简单直观的管理面板以及 实用的 FAQ。基于强大的 PHP 服务器语言以及您 选择的 MySQL、MS-SQL、PostgreSQL 或 Access/ODBC 数据库服务器， phpBB...

QCube Cross-Site-Scripting

A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. id: CVE-2020-24912 info: name: QCube Cross-Site-Scripting author: pikpikcu severity: medium...

CVE-2020-24913-exploit

qcubed-exploit You need Bun to be installed: https://bun.sh To install dependencies: bun install To run: show help bun run exploit -h test for vulnerability bun run exploit vulnerable -u https://site.com/framework/assets/core/php/profile.php create a session for a new target bun run exploit creat...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php Inyección SQL NOMBRE DEL PRODUCTOS AFECTADOS AVL Rooms Página web del vendedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Remitente dazhi Archivo vulnerable /profile.php VERSIÓNES V1.0 Enlace de...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2025-25965

CVE-2025-25965：在线宴会预订系统v1.2中的跨站请求伪造CSRF 简介 跨站请求伪造CSRF仍然是当今影响Web应用程序的最被忽视但最危险的漏洞之一。CVE-2025-25965 是Phpgurukul在线宴会预订系统v1.2 中新发现的CSRF漏洞，允许远程攻击者利用已认证的会话在未经用户同意的情况下更改用户的电子邮件地址。 漏洞概述 CVE ID : CVE-2025-25965 漏洞类型 : 跨站请求伪造CSRF 受影响产品 : Online Banquet Booking System - v1.2 受影响组件 : 用户资料更新功能 profile.php 影响 :...

CVE-2026-93656

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...

EUVD-2026-86596

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

CVE-2026-93656: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

EUVD-2026-82571

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...