850 matches found
CVE-2022-29455
CVE-2022-29455 Wordpress 취약점 - XSS Cross-Site Scripting 취약점 위치 https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js 취약한 버전 예시 - https://www.youtube.com/watch?v=4qvOkSbhcE...
CVE-2022-29455
CVE-2022-29455 워드프레스 취약점 - XSS 크로스 사이트 스크립팅 취약점 위치 https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js 취약한 버전 = 3.5.5 버전 개념 증명 익스플로잇 https://add your target...
CVE-2026-97290
Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...
CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...
CVE-2026-97290
The Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin, in versions
EUVD-2026-90217
Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...
CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...
CVE-2026-87848
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
EUVD-2026-85193
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
CVE-2026-87848
The MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a lack of authorisation or authentication on one of its AJAX actions , combined with a failure to check the status of the requested post. Conse...
WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability
Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...
PT-2026-97274
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
CVE-2026-87848: Missing Authorization
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
PT-2026-95301
Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web...
EUVD-2026-75885
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...
CVE-2026-18121
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...
CVE-2026-18121: Missing Authorization
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...
CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...