Advisories · Technology
ProfileGrid.
Every CVE that names ProfileGrid among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.0 CriticalCritical · CVSS 9+
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
- Frontend Dashboard
- ProfileGrid
- Insecure deserialization
- CVSS 5.3 Medium
ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
- ProfileGrid
- Broken access control
- CVSS 4.3 Medium
ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
- ProfileGrid
- Broken access control
- CVSS 4.3 Medium
ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
- ProfileGrid
- Broken access control
- CVSS 7.5 High
ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
- ProfileGrid
- Privilege escalation
- CVSS 3.8 Low
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
- ProfileGrid
- Broken access control
- CVSS 5.4 Medium
ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization
- ProfileGrid
- Broken access control
- CVSS 6.5 Medium
ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
- ProfileGrid
- Broken access control
- CVSS 4.3 Medium
WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability
- ProfileGrid
- Broken access control
- CVSS 8.8 High
ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset
- ProfileGrid