Description

The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

Remediation

References

CVE-2009-4851

Related Vulnerabilities

MediaWiki Other Vulnerability (CVE-2013-4570)

Dot CMS Other Vulnerability (CVE-2016-4803)

WordPress Plugin My Wish List Cross-Site Scripting (1.4.1)

WordPress Plugin Gallery-Flagallery Photo Portfolio Information Disclosure (4.24)

Seo Panel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-10839)

Severity

Medium

Classification

CVE-2009-4851 CWE-264

Tags

Missing Update Known Vulnerabilities