This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page.
Kiwi TCMS is an open source test management system. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Ĭross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function. The identifier of this vulnerability is VDB-232952. The manipulation of the argument filename leads to unrestricted upload. Affected by this issue is some unknown functionality of the file /settings/account of the component My Profile Page.
A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical.
0 kommentar(er)
