1062 matches found
CVE-2025-48903
CVE-2025-48903 denotes a permission-bypass vulnerability in Huawei HarmonyOS’s media library module. Reported impact indicates potential availability disruption upon successful exploitation. Core details across sources show a local attack with low complexity and no privileges required, but user i...
WordPress plugin Mediabay - WordPress Media Library Folders 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Mediabay - WordPre...
PT-2025-24022 · Huawei · Harmonyos
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A permission bypass vulnerability exists in the media library module. Successful exploitation of this issue may affect availability. Recommendations: At the moment, there is no information...
WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability
WordPress Mediabay - WordPress Media Library Folders plugin = 1.4 - CSRF to Reflected XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Mediabay - WordPress Media Library Folders versions = 1.4...
CVE-2024-31287
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8...
CVE-2024-3519
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2024-5544
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2024-2328
The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2024-11974
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smcsettingstab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it...
CVE-2023-4634
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mlastreamfile' parameter from the /includes/mla-stream-image.php file,...
CVE-2023-52367
Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity...
CVE-2023-36382
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeffrey-WP Media Library Categories plugin = 2.0.0 versions...
CVE-2023-34010
Unauth. Reflected Cross-Site Scripting XSS vulnerability in submodule of David Lingren Media Library Assistant plugin = 3.0.7 versions...
CVE-2023-24385
Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...
CVE-2023-37386
Cross-Site Request Forgery CSRF vulnerability in Media Library Helper plugin = 1.2.0 versions...
CVE-2023-0285
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0279
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-47596
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeffrey-WP Media Library Categories plugin = 1.9.9 versions...