CVE-2024-2775

A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiat...

CVE-2024-2775 Campcodes Online Marriage Registration System user-profile.php cross site scripting

A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiat...

CVE-2024-27995

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restrictio...

CVE-2024-27995

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restrictio...

Campcodes Online Marriage Registration System 跨站脚本漏洞

Online Marriage Registration System is a website builder that supports online marriage registration. A cross-site scripting vulnerability exists in version 1.0 of the Campcodes Online Marriage Registration System, which stems from a cross-site scripting vulnerability in the lname parameter of the...

PT-2024-22023 · Unknown · Campcodes Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Marriage Registration System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross-site...

User profile < 2.0.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The User profile plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVE-2024-29097

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20...

CVE-2024-29097 WordPress User profile plugin <= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20...

CVE-2024-29097 WordPress User profile plugin <= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20...

CVE-2024-29097

CVE-2024-29097 is a Stored XSS in PickPlugins User profile for WordPress caused by improper input neutralization during page generation. Affected versions: up to and including 2.0.20. Public advisories (Red Hat, Wordfence) confirm the issue and indicate a patch has been issued, but the exact patc...

WordPress Plugin User profile security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2024-22717 · Pickplugins · Pickplugins User Profile

Name of the Vulnerable Software and Affected Versions: PickPlugins User profile versions n/a through 2.0.20 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the User profile...

WEBIGniter v28.7.23 - Stored XSS

Title: WEBIGniter v28.7.23 XSS Author: RedTeamer IT Security, Mesut Cetin Date: 09/04/2023 Vendor: https://webigniter.net/ Software: https://webigniter.net/demo Reference: https://portswigger.net/web-security/cross-site-scripting/stored Description: During the user creation process, the 'yourname...

WordPress User profile Plugin <= 2.0.20 is vulnerable to Cross Site Scripting (XSS)

Software User profile Type Plugin Vulnerable versions = 2.0.20 Fixed in 2.0.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29097 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 53c17e5b3988 Credits Kang SeoHee Required privilege...

Design/Logic Flaw

yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify A...

CVE-2024-1806

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.15.1 due to insufficient input sanitizati...

CVE-2024-1071

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

Cross site scripting

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's reg-select-role shortcode in all versions up to, and including, 4.15.0 due to insufficient...

Sql injection

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...