CVE-2025-13808

CVE-2025-13808 affects orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1, specifically the update function in UserController.java of the User Profile Handler. The vulnerability arises from manipulation of the argument ID leading to improper authorization, with remote exploitation ...

EUVD-2025-199953

A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This...

EUVD-2021-2265

Malware in sbrugna...

EUVD-2018-13062

Malware in sbrugna...

EUVD-2019-13211

Malware in sbrugna...

EUVD-2025-26865

Malicious code in bioql PyPI...

EUVD-2023-2203

Malicious code in bioql PyPI...

EUVD-2023-1142

Malicious code in bioql PyPI...

EUVD-2025-4296

Malicious code in bioql PyPI...

EUVD-2024-39096

Malicious code in bioql PyPI...

EUVD-2023-42747

Malicious code in bioql PyPI...

EUVD-2022-49777

Malicious code in bioql PyPI...

CVE-2025-55366

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...

CVE-2025-55366

CVE-2025-55366 affects jshERP v3.5; improper access control in the UserController.java component (controller\UserController.java) allows attackers to arbitrarily reset user passwords and perform horizontal privilege escalation. Affected software/version is jshERP 3.5; underlying cause is access c...

CVE-2024-46607

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file...

CVE-2023-38989

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information...

CVE-2022-46999

Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php...

CVE-2020-25915

Cross Site Scripting XSS vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted userlogin...

CVE-2018-20508

CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...

CVE-2025-25769

Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /controller/UserController.java...