23303 matches found
EUVD-2026-34928
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the profile template scope function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...
CVE-2026-9290
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the profile template scope function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...
CVE-2026-10038
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar...
CVE-2026-7654
creationtimestamp| type| source ---|---|--- 2026-06-05 23:59:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnlduknsmz2g 2026-06-06 00:00:18+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnldvanx2n2s 2026-06-06 00:55:49+00:00| seen|...
CVE-2026-9290
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the profile template scope function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...
CVE-2026-11429
creationtimestamp| type| source ---|---|--- 2026-06-05 23:25:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlbxhyq522a 2026-06-06 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnldvvpv6p2k 2026-06-06 00:00:41+00:00| seen|...
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...
GHSA-2G2G-8P8H-FGWM Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...
CVE-2026-46397
creationtimestamp| type| source ---|---|--- 2026-06-05 21:40:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl42opps527...
CVE-2026-46398
creationtimestamp| type| source ---|---|--- 2026-06-05 21:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3rq4wz32z...
CVE-2026-46400
creationtimestamp| type| source ---|---|--- 2026-06-05 21:30:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3iqrl6u2f...
CVE-2026-45777
creationtimestamp| type| source ---|---|--- 2026-06-05 20:57:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzp3hx2y2k 2026-06-06 09:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnmc35xzgd2f 2026-06-06 09:00:35+00:00| seen|...
CVE-2026-45778
creationtimestamp| type| source ---|---|--- 2026-06-05 20:55:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzklr64m2g...
CVE-2026-11419
creationtimestamp| type| source ---|---|--- 2026-06-05 20:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzcm7lbt24 2026-06-06 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnlsyefnvw23 2026-06-06 04:30:42+00:00| seen|...
CVE-2026-41659
Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint membersassignmentdata.php includes hidden profile fields BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY in its SQL search condition regardless of field visibility settings. While the...
CVE-2026-10807
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/changeprofileimage.php. Executing a manipulation of the argument prprofileimage can lead to unrestricted upload. The attack may be launched remotely. The...
CVE-2026-36388
A Cross-Site Scripting XSS vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker patient to inject a malicious script payload into the User Name parameter, which is stored in the application and...
CVE-2026-9224
Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions Server 2025.3.20.0 and...
CVE-2026-8291
A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogsnnrfnfmhandlenfprofile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to...