WP Original Media Path < 2.4.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Original Media Path Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23674 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c7b76a11201a Credits Rio Darmawan...

CVE-2021-40379

An issue was discovered on Compro IP70 2.087130218, IP570 2.087130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization...

CVE-2020-5512

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

CVE-2020-5512: Improper Limitation of a Pathname to a Restricted Directory

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

Gleez CMS Cross-Site Scripting Vulnerability

Gleez CMS is an extensible open source content management system CMS based on the Kohana framework. A cross-site scripting vulnerability exists in Gleez CMS version 1.2.0, which can be exploited by remote attackers to execute JavaScript code with the help of media/imagecache/resize page...

FreeBSD : py-pylons -- Path traversal bug (f5c58fc1-49c0-11dd-b0ba-00163e000016)

Pylons team reports : The error.py controller uses paste.fileapp to serve the static resources to the browser. The default error.py controller uses os.path.join to combine the id from Routes with the media path. Routes prior to 1.8 double unquoted the PATHINFO, resulting in FileApp returning file...