In2Code

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration. This flaw allows for self-service privilege escalation into arbitrary frontend groups. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The extension does not require a dedicated admin confirmation token when processing admin-approval requests. This allows a regular user to self-approve a pending account by using a user confirmation hash, which can be obtained by any visitor through the public resend-confirmation action. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The user detail view of the extension does not verify if the requested user record matches the configured or logged-in target. This allows visitors with access to the Detail or List plugin to retrieve profile data of other frontend users, such as name, email, date of birth, and address, by providing an arbitrary `user ID`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** femanager versions 8.x **Description** The invitation controller fails to stop processing after redirecting when it encounters invalid input, such as a missing hash or users that are non-existent, disabled, or deleted. This allows an unauthenticated attacker to re-enable and set a new password for any existing frontend user account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.