6611 matches found
PT-2023-31367 · WordPress · Wp Photo Album Plus
Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions through 8.5.02.005 Description: The issue is related to an Authorization Bypass Through User-Controlled Key. This allows for unauthorized access. Recommendations: For WP Photo Album Plus versions through 8.5.02.00...
CVE-2023-49813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...
CVE-2023-49813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...
CVE-2023-49813 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...
CVE-2023-49813
CVE-2023-49813 affects WP Photo Album Plus (WordPress) with Stored XSS due to improper input handling. Vulnerable versions: through 8.5.02.005; fix available in 8.6.01.005. Remediation: update to 8.6.01.005 or apply vendor patch.
WordPress plugin and WordPress cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2023-31368 · WordPress · Wp Photo Album Plus
Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions through 8.5.02.005 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
photo-muramatsu.com Improper Access Control vulnerability OBB-3806964
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-4122
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...
CVE-2023-4122
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...
Unrestricted file upload
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...
CVE-2023-4122
CVE-2023-4122 affects Student Information System v1.0, with an Insecure File Upload vulnerability on the photo parameter of the my-profile page. The underlying issue allows an authenticated attacker to achieve Remote Code Execution on the server hosting the application. Evidence from multiple con...
PT-2023-27855 · Unknown · Student Information System
Name of the Vulnerable Software and Affected Versions: Student Information System version 1.0 Description: The issue allows an authenticated attacker to obtain Remote Code Execution on the server hosting the application through an Insecure File Upload vulnerability. This vulnerability is...
beneluxnaturephoto.net Improper Access Control vulnerability OBB-3803254
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Bypass Vulnerability
Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.5.02.005 Fixed in 8.6.01.005 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-49774 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 23d1af6fe73e Credits Brandon Roldan...
WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)
Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.5.02.005 Fixed in 8.6.01.003 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-49812 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 10e03ebd1bf6 Credit...
CVE-2023-6412
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all...
PT-2023-32643 · Unknown · Voovi Social Networking Script
Name of the Vulnerable Software and Affected Versions: Voovi Social Networking Script version 1.0 Description: A SQL injection vulnerability has been reported in Voovi Social Networking Script, affecting the photo.php file with multiple parameters. This could allow a remote attacker to send a...
Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation
Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.9.25 due to missing validation on a user-controlled key. This can allow unauthenticated attackers to manipulate orders that do not belong to them...