CVE-2026-126461

OpenEMR versions before 8.5.0 are affected by a missing authorization vulnerability in library/ajax/user_settings.php. This flaw allows any authenticated user to persist arbitrary global configuration overrides. By sending a POST request with global:- prefixed keys, an attacker can re-point exter...

CVE-2026-126487

OpenEMR versions before 8.5.0 are vulnerable to an authorization bypass (CWE-269) in the library/ajax/user_settings.php component. This flaw allows authenticated users to override system-wide global configuration values by submitting keys with a global: prefix. Impact includes the ability to disa...

CVE-2026-27506: Improper Neutralization of Input During Web Page Generation

SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow usersettings.php submitting to admin/updateuser.php. Authenticated users can store malicious HTML/JavaScript in fields such as Firstname, lastname, email, and imageurl, which ar...

CVE-2014-3866

Multiple cross-site request forgery CSRF vulnerabilities in usersettings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that change the 1 administrative password via the passwordc parameter or 2 administrative e-mail address vi...

CVE-2014-3866: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in usersettings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that change the 1 administrative password via the passwordc parameter or 2 administrative e-mail address vi...

CVE-2009-4788: Improper Input Validation

Multiple open redirect vulnerabilities in Pligg 1.0.2 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the 1 return parameter to pligg/login.php and the 2 HTTP Referer header to usersettings.php...