Description

The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

Remediation

References

CVE-2009-4851

Related Vulnerabilities

WordPress Plugin Easy Org Chart Cross-Site Scripting (3.1)

WordPress Plugin Delete All Comments Easily Cross-Site Request Forgery (1.3)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-2067)

WebLogic Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2018-11040)

phpMyFAQ Other Vulnerability (CVE-2006-6913)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2009-4851