PT-2026-95141

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description A flaw exists in the way user profile bios are processed. The file 'app/controller/user/profile.php' accepts the userbio field and processes it using the sanitizeHTML function in...

CVE-2026-54506: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2025-10098: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The exploit has been released to the publ...

CVE-2025-7542: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul User Registration & Login and User Management System 3.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/user-profile.php. The manipulation of the argument uid leads to sql injection. The attack may be...

CVE-2025-5659: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in PHPGurukul Complaint Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /user/profile.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The explo...

CVE-2025-4785: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user-profile.php. The manipulation of the argument fullname/contactnumber leads to sql injection. The attack may be launched...

PT-2025-21666 · Unknown · Phpgurukul Daily Expense Tracker System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Daily Expense Tracker System version 1.1 Description: A critical issue was found in the system, affecting some unknown functionality of the file /user-profile.php. The manipulation of the fullname and contactnumber arguments leads ...

CVE-2024-2775 Campcodes Online Marriage Registration System user-profile.php cross site scripting

A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiat...

CVE-2024-2775: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiat...

CVE-2023-7052: Cross-Site Request Forgery (CSRF)

A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. Th...

CVE-2023-7050: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file user/profile.php. The manipulation of the argument name/email leads to cross site scripting. The attack can be launche...

CVE-2021-39348

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $customprofile parameter found in the /inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in version...

CVE-2021-39348: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $customprofile parameter found in the /inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in version...

Design/Logic Flaw

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field...

PT-2021-16990

Name of the Vulnerable Software and Affected Versions PHPGurukul Daily Expense Tracker System version 1.0 Description The issue concerns a stored XSS vulnerability via the Full Name field in the user-profile.php page. This allows for malicious scripts to be stored and executed when the page is...

CVE-2021-26303: Improper Neutralization of Input During Web Page Generation

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field...

Cross site scripting

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

CVE-2020-24194

CVE-2020-24194 is an XSS vulnerability in SourceCodester Daily Tracker System v1.0, exploitable via the fullname parameter in user-profile.php to inject arbitrary web script/HTML. The provided connected documents confirm the issue but do not specify affected versions beyond v1.0, nor provide a re...

CVE-2020-24194

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

CVE-2020-24194: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...