Beaver Builder < 2.8.1.3 - Contributor+ Stored Cross-Site Scripting via photo widget crop attribute

Description The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

Phormer 安全漏洞

Phormer is a PHP-based photo gallery manager application. A security vulnerability exists in Phormer that stems from a cross-site scripting vulnerability in Phormer...

WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP Photo Album Plus versions = 8.7.01.001...

CVE-2024-20859

Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without privilege...

Sunshine Photo Cart: Free Client Photo Galleries for Photographers < 3.1.2 - Unauthenticated PHP Object Injection

Description The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP...

WordPress WP Photo Album Plus Plugin <= 8.7.01.001 is vulnerable to Arbitrary File Upload

Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.7.01.001 Fixed in 8.7.01.002 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31377 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6676bd224b42 Credits stealthcopter Required...

CVE-2024-34382 WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.18 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18...

Library System 安全漏洞

Library System is a library management system by nurhodelta17 individual developer. A security vulnerability exists in Library System version V1.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the FAILE variable in the Studenteditphoto.php component...

PT-2024-25190 · Unknown · Library System

Name of the Vulnerable Software and Affected Versions: Library System version V1.0 Description: An issue in the Library System allows a remote attacker to execute arbitrary code via the FAILE variable in the student edit photo.php component. Recommendations: For Library System version V1.0,...

CVE-2024-4500

A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Employee/edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. The attack can be initiated remotely...

Prison Management System 代码问题漏洞

Prison Management System is a prison management system by the individual developer Carlo Montero. A code issue vulnerability exists in SourceCodester Prison Management System version 1.0, which stems from the parameter userImage in the file /Employee/edit-photo.php that can lead to unrestricted...

CVE-2024-34469

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

PT-2024-25920 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel versions prior to 3.5.3 Description: The issue allows for XSS via the user photo parameter to My Page. This can potentially lead to malicious script execution. Recommendations: For versions prior to 3.5.3, update to version 3.5.3 ...

Rukovoditel 跨站脚本漏洞

Rukovoditel is a web-based open source project management software from the Rukovoditel team. The software features project management, customer relationship management, and more. A cross-site scripting vulnerability exists in Rukovoditel versions prior to 3.5.3, which stems from allowing...

Rukovoditel 跨站脚本漏洞

Rukovoditel is a web-based open source project management software from the Rukovoditel team. The software features project management, customer relationship management, and more. A cross-site scripting vulnerability exists in Rukovoditel versions prior to 3.5.3, which stems from allowing...

CVE-2024-3724

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo Stack, & Horizontal Timeline widgets in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-1896

The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awllgsettings'...

CVE-2024-3724

CVE-2024-3724 (Happy Addons for Elementor) : WordPress plugin Happy Addons for Elementor (versions

CVE-2024-1896 Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode

The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awllgsettings'...

CVE-2024-1896 Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode

The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awllgsettings'...