CVE-2025-48340

CVE-2025-48340 refers to a CSRF to Privilege Escalation vulnerability in WordPress plugin User Profile Meta Manager (Danny Vink), affecting versions 1.02 and earlier. The issue enables privilege escalation through CSRF; no exploitation details are provided in the sources. Remediation guidance fro...

CVE-2025-48340 WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery CSRF vulnerability in Danny Vink User Profile Meta Manager allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through 1.02...

CVE-2025-4785

CVE-2025-4785 affects PHPGurukul Daily Expense Tracker System version 1.1. The vulnerability is a SQL injection in the file /user-profile.php triggered by manipulating the fullname and contactnumber parameters, with remote exploit potential. Multiple connected sources confirm the issue and indica...

PHPGurukul Daily Expense Tracker System 安全漏洞

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. Daily Expense Tracker System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter fullname/contactnumber in the file...

CVE-2024-6708

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

CVE-2024-6708

CVE-2024-6708 affects the WordPress plugin User Profile Builder , with versions prior to 3.12.2. The root cause is insufficient sanitisation/escaping of parameters in content output in the admin area, enabling Admin+ users to perform Cross-Site Scripting (XSS). The known impact is stored XSS in a...

CVE-2024-6708 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

CVE-2024-6708 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks...

PT-2025-21490 · WordPress · User Profile Builder

Name of the Vulnerable Software and Affected Versions: The User Profile Builder WordPress plugin versions prior to 3.12.2 Description: The issue allows Admin+ users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters before outputting its...

WordPress plugin User Profile Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the _parse/load_user-profile.php file in the Job Recruitment system allows a hacker to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the parse/loaduser-profile.php file in the Job Recruitment system is related to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information and execute arbitra...

BIT-MOODLE-2024-43429 Moodle: user information visibility control issues in gradebook reports

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information...

CVE-2025-4175

CVE-2025-4175 affects AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. The vulnerability is in the function uploadUserProfileImage of the file UserProfileController.java within the Upload Profile API Endpoint. Manipulation of the File argument leads to a path traversal, enabling a remote at...

GHSA-5XV6-7JM3-FMG5

creationtimestamp| type| source ---|---|--- 2025-04-30 15:57:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114427734857012817 2025-04-30 17:32:01+00:00| seen| Telegram/Gwvh-n-ygZ7AZvt4Z14lI64V1AihU4WxZxoYYl7z1l7jTPI...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...

CVE-2025-25776

Cross-Site Scripting XSS vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing...

PT-2025-18071 · Unknown · Codeastro Bus Ticket Booking System

Name of the Vulnerable Software and Affected Versions: Codeastro Bus Ticket Booking System version 1.0 Description: A Cross-Site Scripting XSS issue exists in the User Registration and User Profile features, allowing an attacker to execute arbitrary code in the Full Name and Address fields during...

CVE-2025-25776

Codeastro Bus Ticket Booking System v1.0 is affected by CVE-2025-25776: a Cross-Site Scripting (XSS) flaw in the User Registration and User Profile features caused by insufficient input validation on the Full Name and Address fields. Exploitation could allow arbitrary code execution in these fiel...