237 matches found
CVE-2026-111972
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...
CVE-2026-111971
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...
EUVD-2026-108016
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...
EUVD-2026-108017
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...
WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.5.8 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.5.8...
PT-2026-121273
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...
PT-2026-121272
The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...
CVE-2026-107770
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions ¦6.5.6 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to permanently delete arbitrary media attachments using wp_delete_attach...
CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
EUVD-2026-102787
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
CVE-2026-107770: Missing Authorization
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
Adobe Lightroom Classic < 15.5 Multiple Arbitrary code execution (APSB26-94)
The version of Adobe Lightroom Classic installed on the remote Windows host is prior to 15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-94 advisory. - Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path...
Adobe Lightroom Classic Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Adobe Lightroom Classic Buffer Overflow Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Adobe Lightroom Classic Auth Bypass RCE
The vulnerability of Adobe Lightroom Classic’s graphic editor is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...
Adobe Lightroom Classic Integer Overflow RCE
The vulnerability of the Adobe Lightroom Classic graphic editor is related to a potential integer overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Adobe Lightroom Classic Buffer Overflow Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Adobe Lightroom Classic Buffer Overflow Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Adobe Lightroom Classic Buffer Overflow Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...