CVE-2023-23674

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

CVE-2023-23674

CVE-2023-23674 – WP Original Media Path (RVOLA) Stored XSS in plugin versions

WordPress plugin WP Original Media Path 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Original Media Path Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23674 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c7b76a11201a Credits Rio Darmawan...

WP Original Media Path < 2.4.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2021-40379

An issue was discovered on Compro IP70 2.087130218, IP570 2.087130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization...

Gleez CMS Cross-Site Scripting Vulnerability

Gleez CMS is an extensible open source content management system CMS based on the Kohana framework. A cross-site scripting vulnerability exists in Gleez CMS version 1.2.0, which can be exploited by remote attackers to execute JavaScript code with the help of media/imagecache/resize page...

FreeBSD : py-pylons -- Path traversal bug (f5c58fc1-49c0-11dd-b0ba-00163e000016)

Pylons team reports : The error.py controller uses paste.fileapp to serve the static resources to the browser. The default error.py controller uses os.path.join to combine the id from Routes with the media path. Routes prior to 1.8 double unquoted the PATHINFO, resulting in FileApp returning file...