CVE-2026-1213

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-121303.5A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/AdCVE-2026-121316.3A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the filCVE-2026-121334.3The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary CVE-2026-121344.3The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versionCVE-2026-121356.4The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' atCVE-2026-121366.4The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' sCVE-2026-121376.1The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to RefleCVE-2026-121395.5Tanium addressed an information disclosure vulnerability in Connect.CVE-2026-121414.9The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-121427.2The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array PaCVE-2026-121437.5form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#appenCVE-2026-121448.8The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This i
CVE-2026-1213: Medium severity, CVSS 4.3 | Vulnix