3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

Description The plugin does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as...

WordPress 3DPrint Lite plugin <= 1.9.1.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Spacehen in WordPress 3DPrint Lite plugin versions = 1.9.1.4. Solution Update the WordPress 3DPrint Lite plugin to the latest available version at least 1.9.1.5...

WordPress 3DPrint Lite 1.9.1.4 Shell Upload

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage:...

Wordpress 3DPrint Lite 1.9.1.4 Plugin - Arbitrary File Upload Exploit

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage: print"Usage: python3...

Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage:...

WP Import Export Lite < 3.9.5 - Subscriber+ Extensions Update

The plugin does not have any CSRF and authorisation checks done in wpieextsaveextensions AJAX action. This could allow any authenticated user such as subscriber, or an unauthenticated attacker via a CSRF to set the extensions to be used by the plugin, as well as disable all of them To disabled al...

Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site Scripting

Description The plugin does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks dflip class='"...

The vulnerability in the implementation of the TCP checksum function for TCP/IP protocols such as NicheLite and InterNiche allows a attacker to cause a service failure.

The vulnerability of the TCP checksum implementation in the TCP/IP protocols NicheLite and InterNiche is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2021-7168 · Yandex · Yandex Browser Lite

Name of the Vulnerable Software and Affected Versions: Yandex Browser Lite for Android affected versions not specified Description: The issue is related to errors in the user interface's representation of information. It may allow a remote attacker to exploit the vulnerability by substituting the...

PT-2021-7167 · Yandex · Yandex Browser Lite

Name of the Vulnerable Software and Affected Versions: Yandex Browser Lite for Android affected versions not specified Description: The issue is related to authentication bypass via spoofing, which could allow a remote attacker to cause a denial of service. Recommendations: At the moment, there i...

PT-2021-7166 · Yandex · Yandex Browser Lite

Name of the Vulnerable Software and Affected Versions: Yandex Browser Lite for Android affected versions not specified Description: The issue is related to an authentication bypass via spoofing, which could allow a remote attacker to replace the value of the address bar. Recommendations: At the...

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Go to the plugin Settings Messages Taxonomies...

WordPress Modern Events Calendar Lite plugin <= 5.22.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Shivam Rai in WordPress Modern Events Calendar Lite plugin versions = 5.22.1. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.22.2...

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the plugin Settings Messages Taxonomies...

CVE-2021-24580

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

Sql injection

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

CVE-2021-24580 Side Menu Lite < 2.2.6 - Authenticated SQL Injection

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

CVE-2021-24580

CVE-2021-24580 refers to the WordPress plugin Side Menu Lite prior to 2.2.6, which has an authenticated SQL Injection flaw. The issue arises because the plugin does not sanitize user input from the List page in the admin dashboard before using it in a SQL statement, allowing an attacker with admi...

(0Day) Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

(0Day) Fuji Electric Tellus Lite V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...