User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

Moodle-CVE-2019-3810

Moodle CVE-2019-3810 Moodle 3.6.2, 3.5.4, 3.4.7, 3.1.16 XSS PoC for Privilege Escalation Student to Admin. This is one of the past bugs that I discovered during past pentest in an academic institution. It was successful enough at the time to practically steal admin access and gain complete contro...

CVE-2019-0986

趣味安全研究 全部聚焦于 Microsoft Windows 操作系统 CVE-2019-0986 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0986 这是我向 Microsoft 报告上述漏洞时发送的 PoC 该 PoC 利用“用户配置文件服务”ProfSvc.dll。 它将删除任意目录中的所有文件，无论该目录设置了何种权限 （被 SYSTEM 进程独占锁定的文件除外）。 利用前提条件： 1. 攻击者用户不能有当前活动会话（他必须已从系统注销）。 2. 攻击者用户必须有一个已存...

CVE-2025-55182-PoC

CVE-2025-55182-PoC CVE-2025-55182 के लिए प्रमाण-अवधारणा root@kitploit: Usage: python3 poc.py -u http://target.com --cmd "" कानूनी अस्वीकरण यह उपकरण केवल शैक्षिक उद्देश्यों और अधिकृत सुरक्षा परीक्षण के लिए प्रदान किया गया है। बिना पूर्व आपसी सहमति के लक्ष्यों पर हमला करने के लिए इस उपकरण का उपयोग...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Em seguida, visualize o post feito pelo autor para disparar o XSS Vídeo POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

profilehound

root@kitploit: / \ / / / / / / / / / // / / / // / / / // / / / / / / / / / / / // / / / / / / // / // / / / / // / // // // ///// ///,// //,/ ProfileHound ProfileHound è uno strumento post-elevazione progettato per aiutare a individuare e raggiungere obiettivi di red-teaming, localizzando...

CVE-2024-6366

Um ein Metasploit-Modul zu erstellen, um die RCE-Sicherheitslücke im WordPress-Plugin User Profile Builder vor Version 3.11.8 auszunutzen, müssen wir die fehlende ordnungsgemäße Autorisierung in der Funktion zum Hochladen von Mediendateien ausnutzen. Hier erfahren Sie, wie Sie ein solches...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Reset Password Arbitrario Non Autenticato CVE-2025-15030 User Profile Builder — Reset Password Non Autenticato → Compromissione Admin + Upload Shell root@kitploit: / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / | / /| \ | || | / | / ||...

LegacyHive

LegacyHive : Vulnerabilità di elevazione dei privilegi tramite caricamento arbitrario di hive nel servizio profilo utente di Windows Il PoC richiede le credenziali di un altro utente standard e un terzo nome utente che può essere un account amministratore; se il PoC ha successo, finirà per montar...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Caricamento media non autenticato Descrizione Il plugin WordPress User Profile Builder precedente alla versione 3.11.8 non dispone di una corretta autorizzazione, consentendo a utenti non autenticati di caricare file media tramite la funzionalità ...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2020-25627

CVE-2020-25627 XSS persistente tramite il parametro moodlenetprofile nel profilo utente La mia PoC su questa CVE Requisito utente: Studente o il sito per la registrazione XSS in moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user...

CVE-2022-38577-Processmaker

Questo repository è stato archiviato e spostato su: https://github.com/sornram9254/CVE-BBP-VDP ProcessMaker - Escalation dei privilegi del profilo utente CVE-2022-38577 È stato scoperto che ProcessMaker prima della v3.5.4 contiene permessi insicuri nella pagina del profilo utente. Questa...

Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

CVE-2026-15826

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826

The User Profile Builder WordPress plugin (≤ 3.16.4) is vulnerable to unauthenticated authentication bypass via type confusion , rated CVSS 9.8 Critical . The root cause is in wppb_log_in_user(), which calls absint() on the return value of wp_insert_user() before the is_wp_error() check. A regist...

CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

EUVD-2026-59593

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...