bmc-tools

BMC-Tools RDP位图缓存解析器。 输入 bmc-tools 处理Windows用户配置文件中的 bcache.bmc 和 cache????.bin 文件。 用法 ./bmc-tools.py -h -s SRC -d DEST -c COUNT -v -o -b -w WIDTH 各参数含义如下： -h, --help 显示此帮助信息并退出 -s SRC, --src SRC 指定要处理的BMCache文件或目录。 -d DEST, --dest DEST 指定存储提取位图的目录。 -c COUNT, --count COUNT 仅提取指定数量的位图。 -v, --verbo...

EUVD-2026-86596

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-93656

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...

CVE-2026-6431: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-75964: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75965: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

CVE-2026-21060

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles...

CVE-2026-21060

Samsung Contacts shows an improper input validation vulnerability in the app prior to SMR Aug-2026 Release 1, enabling a physical attacker to access data across multiple user profiles. The issue affects Samsung Contacts on affected devices and has a CVSS 4.0 vector with a base score of 6.7 (Mediu...

CVE-2026-18200 FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-18200

The FoodBoxBooker WordPress plugin versions prior to 1.0.8 contains an authorization bypass vulnerability. The plugin fails to verify that the user account being updated belongs to the user initiating the request. This flaw allows authenticated users with Subscriber-level access and above to modi...

CVE-2026-21060: Improper Input Validation

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles...

keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

CVE-2026-15257

The RegistrationMagic WordPress plugin (versions before 6.0.9.4 ) is vulnerable to an authorization bypass because it fails to perform authorization , ownership , or nonce checks on a front-end submission-editing action. This flaw allows unauthenticated attackers to overwrite form submissions bel...

CVE-2026-57697: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through = 5.9.9.6...

CVE-2026-11359: Missing Authorization

The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the...

Indico may disclose unauthorized user details access via legacy API

ImpactA legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. PatchesYou should to update to Indico 3.3.8 as soon as possible.See the docs for instructions on how to update. WorkaroundsIt is...

CVE-2026-11766 Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, includin...

CVE-2026-14209

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

CVE-2026-14209

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

CVE-2026-12073: Authorization Bypass Through User-Controlled Key

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a userlogin on registration forms that don't contain this parameter, and...