Ajax Search Lite < 4.11.1 - Subscriber+ Sensitive Data Disclosure

The plugin does not have authorisation and CSRF checks in the wdsearchcf AJAX action, which could allow any authenticated users to call it and retrieve arbitrary post metadata Note: v4.11 added only a CSRF check, authorisation was added in 4.11.1...

WordPress plugin WZone–Lite 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure

Software Ajax Search Lite Type Plugin Vulnerable versions = 4.10.3 Fixed in 4.11 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-38456 Patch priority Medium CVSS severity Medium 4.3 Developer WPdreams PSID 59c3957625b5 Credits István Márton Required...

Cross-site Scripting (XSS)

serve-lite is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the main function in server.js renders the listing file with all of its contents with links that include the actual file names without any sanitization or output encoding, allowing an attacker to inject and...

Directory Traversal

serve-lite is vulnerable to Directory Traversal. The vulnerability is due to a a lack of input sanitization in the req.url parameter which is passed as-is to the path.join function, allowing a remote attacker to access system files and retrieve confidential information via malicious input...

WordPress Real Media Library Lite Plugin < 4.18.29 is vulnerable to Cross Site Scripting (XSS)

Software Real Media Library Lite Type Plugin Vulnerable versions 4.18.29 Fixed in 4.18.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0285 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 7250628ea15a Credits Bipul...

CVE-2022-4828 Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode

The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

WordPress plugin Bold Timeline Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Directory Traversal vulnerability in serve-lite

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...

GHSA-5QQ4-M6C3-XXMF Directory Traversal vulnerability in serve-lite

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...

GHSA-J8X7-QCW4-XX85 Cross-site Scripting (XSS) in serve-lite

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

Cross-site Scripting (XSS) in serve-lite

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

CVE-2023-0448

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability...

Cross site scripting

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability...

CVE-2022-25847

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

CVE-2022-21192

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...

Directory traversal

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...

Cross site scripting

All versions of the package serve-lite are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding...

WordPress plugin WP Helper Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

serve-lite 跨站脚本漏洞

serve-lite is a lightweight http server for static file-based web development. A security vulnerability exists in serve-lite that stems from presenting file listings without cleaning or escaping them when a request for a directory is received...