9957 matches found
CVE-2021-24145
CVE-2021-24145 affects WordPress plugin Modern Events Calendar Lite versions before 5.16.5. The issue is an authenticated arbitrary file upload vulnerability: the plugin does not properly validate the imported file, allowing an administrator or other high-privilege user to upload PHP payloads by ...
CVE-2021-24149
CVE-2021-24149 affects WordPress plugin Modern Events Calendar Lite
CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...
CVE-2021-24126 Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...
CVE-2021-24126
The CVE-2021-24126 entry concerns the Envira Gallery Lite WordPress plugin (versions before 1.8.3.3). The issue arises from unvalidated input and a lack of output encoding when sanitising image metadata (specifically the title) before it is rendered in the generated gallery. This handling is desc...
PT-2021-15693
Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5 Description: The issue is related to unvalidated input and lack of output encoding in the plugin. Specifically, the mic comment field, also known as 'Notes on time', is not...
PT-2021-15695
Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.6 Description: The issue concerns unvalidated input in the Modern Events Calendar Lite WordPress plugin, which did not sanitize the mecpost id POST parameter in the "mec fes...
Envira Gallery Lite 跨站脚本漏洞
Envira Gallery Lite is a plugin from Envira Gallery that provides responsive gallery functionality for Wordpress. A cross-site scripting vulnerability exists in the WordPress Envira Gallery Lite plugin before 1.8.3.3, which stems from not properly cleaning image metadata, leading to privilege...
Wordpress Modern Events Calendar Lite 跨站脚本漏洞
Wordpress Modern Events Calendar Lite is Wordpress open source plugin for an application. The plugin is used to manage the best tools for events website. A cross-site scripting vulnerability exists in the Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5. The vulnerability ste...
CVE-2021-24147: Improper Neutralization of Input During Web Page Generation
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...
CVE-2021-24126: Improper Neutralization of Input During Web Page Generation
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...
CVE-2021-24146: Improper Access Control
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example...
CVE-2021-24145: Unrestricted Upload of File with Dangerous Type
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...
CVE-2021-24149: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue...
PT-2021-15671
Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite WordPress plugin versions prior to 1.8.3.3 Description: The issue is related to unvalidated input and lack of output encoding, which could lead to privilege escalation. Specifically, the images metadata, namely the title,...
Wordpress Modern Events Calendar Lite 代码问题漏洞
Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. A code issue vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from an arbitrary file upload that...
Wordpress Modern Events Calendar Lite 访问控制错误漏洞
Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. An access control error vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from not properly...
WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.8.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by NintechNet in WordPress Abandoned Cart Lite for WooCommerce plugin versions = 5.8.5. Solution Update the WordPress Abandoned Cart Lite for WooCommerce plugin to the latest available version at least 5.8.6...
