CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

EUVD-2026-114073

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2026-119657 FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2026-119657 FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2026-119657 FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2026-119657

FilePress versions up to and including 3.0.1 are vulnerable to a missing authorization flaw in the dzz/pichome/library component. The root cause is that the checkuserperm_by_uid function fails to verify specific library ownership, only checking if a user belongs to any library. This allows authen...

CVE-2026-119657: zyx0814 FilePress: FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated…

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

PT-2026-133587

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm by uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2024-8170

A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2024-8170 SourceCodester Zipped Folder Manager App add-folder.php unrestricted upload

A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2024-8170 SourceCodester Zipped Folder Manager App add-folder.php unrestricted upload

A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2024-8170: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2021-34668

The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the /inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1...

CVE-2021-34668: Improper Neutralization of Input During Web Page Generation

The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the /inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1...

MediaLab SQL Injection

| @@@@@@@@ @@@@@@@@@ @@ @@ @@@@@ @@ @@ @@@@@@@@ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @@@ @ @ @ @ @ @ @ @ @ @ @ | | @@@@@@@@ @@@ @@@ @ @ @ @ @ @ @ @ @ @@@@@@@@ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ | | @@@@@@@@ ...

CVE-2009-4359

Cross-site scripting XSS vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter...

CVE-2009-4359

The CVE refers to a Cross-site Scripting (XSS) vulnerability in folder.php of the SmartMedia 0.85 Beta module for XOOPS, exploitable via the categoryid parameter. The affected component is the SmartMedia 0.85 Beta XOOPS module; root cause is an XSS flaw that allows injecting arbitrary script/HTML...

CVE-2009-4359: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter...

XOOPS SmartMedia 0.85 Module XSS

No description provided by source. Exploit Title: XOOPS Module Smartmedia XSS Version : SmartMedia 0.85 Date: 2009-11-30 Discovred By : SoldierOfAllah Software Link: http://dev.xoops.org/dl/smartmedia/5 - Beta and RC Releases/SmartMedia 0.85 Beta/XOOPS2modsmartmedia0.85BETAsmartfactory.zip CVE-ID...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...