CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454

CVE-2026-6454 affects the WordPress Firelight Lightbox plugin (versions up to 2.3.20). The root cause is improper sanitization of the href value in the FancyBox V2 PDF beforeLoad callback (inc/fancybox-2.php), where this.href is directly concatenated into HTML without escaping, allowing a stored ...

EUVD-2011-5043

Malware in sbrugna...

SECOM WRTM326 操作系统命令注入漏洞

The SECOM WRTM326 is a wireless router from China Zhongbao SECOM. An operating system command injection vulnerability exists in the SECOM WRTM326 versions prior to 2.3.20. The vulnerability stems from failure to properly validate specific parameters, which could allow a remote attacker to execute...

AZL-69869 CVE-2024-25584 affecting package dovecot 2.3.20-1

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

Apache Sling Servlets Post Cross-Site Scripting Vulnerability (CNVD-2017-37560)

Adobe Experience Manager AEM is the United States of America Ordoby Adobe can be used to build a set of web sites, mobile applications and forms of content management solutions. The program supports mobile content management, marketing and sales campaign management and multi-site management , etc...

Apache Struts 'Problem Report' XSS Vulnerability (S2-025)

Apache Struts is prone to a cross-site scripting XSS vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Apache Struts Convention Plugin Path Traversal Vulnerability

Struts2 is an extensible framework for building enterprise-class Jave Web applications. Struts 2.3.20 - 2.3.31 has a path traversal vulnerability in the Convention plugin, which can be exploited by an attacker to conduct path traversal and code execution attacks on the server side via a construct...

Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-04093)

Apache Struts is the United States Apache Apache Software Foundation is responsible for maintaining an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2...

Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution', 'Description' = %q This module exploits a remo...

[ANN] Apache Struts 2.3.20 GA release available with security fix

The Apache Struts group is pleased to announce that Apache Struts 2.3.20 is available as a "General Availability" release. The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is...

FrontAccounting 'attachments.php'任意文件上传漏洞

Bugtraq ID:66217 FrontAccounting FA是一个针对企业ERP供应链的网页会计系统。 FrontAccounting /admin/attachments.php脚本存在安全漏洞，允许攻击者上传使用恶意扩展名的文件，并以WEB权限执行。 0 FrontAccounting 2.x FrontAccounting 2.3.20已经修复该漏洞，建议用户下载更新： http://frontaccounting.com...