EUVD-2026-66182

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16638: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

DRUPAL-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

CVE-2026-41933

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...

CVE-2026-41933 Vvveb < 1.0.8.3 Directory Listing Information Disclosure

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...

EUVD-2026-30294

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...

EUVD-2025-206074

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4...

WordPress MediaCommander plugin <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion vulnerability

Missing Authorization to Authenticated Author+ Media Folder Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin MediaCommander versions = 2.3.1...

WordPress Media Library Folders plugin <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection vulnerability

Authenticated Subscriber+ Second-Order SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin Media Library Folders versions = 8.2.2...

Cross-Site Request Forgery in Spina

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/mediafolders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2024-7106 Spina CMS media_folders cross-site request forgery

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/mediafolders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

PT-2024-38079 · Spina Cms · Spina Cms

Name of the Vulnerable Software and Affected Versions: Spina CMS version 2.18.0 Description: A problematic vulnerability was found in Spina CMS, affecting an unknown functionality of the file /admin/media folders. This leads to cross-site request forgery. The attack can be launched remotely. The...

Cross-Site Request Forgery in Spina

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/mediafolders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

Path Traversal

mautic/core is vulnerable to Path Traversal. The vulnerability is due to inadequate input validation in the GrapesJS builder implementation within FileManagerController.php, allowing logged-in users to delete critical files outside media folders...