CVE-2022-20034

In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20034

CVE-2022-20034 refers to a vulnerability in Preloader XFLASH on MediaTek devices caused by improper certificate validation, enabling local privilege escalation if an attacker has physical access and no extra privileges or user interaction are required. Connected documents corroborate the issue as...

PT-2022-14281

Name of the Vulnerable Software and Affected Versions Preloader XFLASH affected versions not specified Description The issue is related to an improper certificate validation, which could lead to a local escalation of privilege. An attacker with physical access to the device can exploit this witho...

CVE-2022-20034: Improper Certificate Validation

In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not needed for...

MediaTek 芯片信任管理问题漏洞

MediaTek chips are a variety of chips from MediaTek, a division of China's MediaTek Mediatek. A security vulnerability exists in the MediaTek chips, which originates in Preloader XFLASH and could lead to privilege escalation due to improper certificate validation. An attacker could exploit the...

PT-2021-16180

Name of the Vulnerable Software and Affected Versions MAZ Loader – Preloader Builder for WordPress plugin versions prior to 1.3.3 Description The issue concerns the MAZ Loader – Preloader Builder for WordPress plugin, where the loader id parameter of the mzldr shortcode is not properly validated ...

CVE-2021-24669: Improper Neutralization of Special Elements used in an SQL Command

The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loaderid parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection...

WordPress Flat Preloader plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Flat Preloader Plugin in versions prior to 1.5.5 has a cross-site scripting vulnerability that stems from...

CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24685

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

CVE-2021-24685

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789 Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789

The CVE refers to WordPress Flat Preloader plugin pre-1.5.5. Connected sources confirm a cross-site scripting (XSS) vulnerability where certain settings are not escaped when output in HTML attributes, enabling an attacker with admin-level access to trigger client-side JS even when unfiltered_html...

CVE-2021-24685 Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

CVE-2021-24685

The CVE-2021-24685 affects the Flat Preloader WordPress plugin prior to version 1.5.4. Root cause: the plugin does not enforce nonce checks when saving settings and fails to sanitise/escape inputs, enabling a logged-in admin to modify settings that can trigger stored Cross-Site Scripting (XSS) pa...

CVE-2021-24789: Improper Neutralization of Input During Web Page Generation

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

PT-2021-16283

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings when outputting them in attributes in the...

CVE-2021-24685: Cross-Site Request Forgery (CSRF)

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Flat Preloader Plugin in versions prior to 1.5.5 has a cross-site scripting vulnerability that stems from...