Cross site scripting

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...

Cross site request forgery (csrf)

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...

CVE-2021-24147

The CVE-2021-24147 entry concerns the WordPress plugin Modern Events Calendar Lite (pre-5.16.5). Affected component: mic_comment field in event creation/editing; root cause is unvalidated input and lack of output encoding, enabling Cross-Site Scripting when events are viewed. Impact is since low-...

CVE-2021-24149

CVE-2021-24149 affects WordPress plugin Modern Events Calendar Lite

CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request...

CVE-2021-24145

CVE-2021-24145 affects WordPress plugin Modern Events Calendar Lite versions before 5.16.5. The issue is an authenticated arbitrary file upload vulnerability: the plugin does not properly validate the imported file, allowing an administrator or other high-privilege user to upload PHP payloads by ...

CVE-2021-24126 Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

CVE-2021-24126

The CVE-2021-24126 entry concerns the Envira Gallery Lite WordPress plugin (versions before 1.8.3.3). The issue arises from unvalidated input and a lack of output encoding when sanitising image metadata (specifically the title) before it is rendered in the generated gallery. This handling is desc...

Wordpress Modern Events Calendar Lite 代码问题漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. A code issue vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from an arbitrary file upload that...

Envira Gallery Lite 跨站脚本漏洞

Envira Gallery Lite is a plugin from Envira Gallery that provides responsive gallery functionality for Wordpress. A cross-site scripting vulnerability exists in the WordPress Envira Gallery Lite plugin before 1.8.3.3, which stems from not properly cleaning image metadata, leading to privilege...

Wordpress Modern Events Calendar Lite 跨站脚本漏洞

Wordpress Modern Events Calendar Lite is Wordpress open source plugin for an application. The plugin is used to manage the best tools for events website. A cross-site scripting vulnerability exists in the Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5. The vulnerability ste...

Wordpress Modern Events Calendar Lite 访问控制错误漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. An access control error vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from not properly...

WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.8.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by NintechNet in WordPress Abandoned Cart Lite for WooCommerce plugin versions = 5.8.5. Solution Update the WordPress Abandoned Cart Lite for WooCommerce plugin to the latest available version at least 5.8.6...

CVE-2020-25171

The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-25171

The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...

Out-of-bounds

The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-25171 Fuji Electric V-Server Lite

The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-25171

The CVE-2020-25171 issue affects Fuji Electric V-Server Lite before version 3.3.24.0. The vulnerability is an out-of-bounds write in the VPR file parsing code, which can enable remote code execution. ZDI-tied advisories state exploitation requires user interaction (the target must load a maliciou...

U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure

hi team , i found that aem is running on ████████ and CRXDE Lite/CRX is exposed to unauthenticated user that can lead to information disclosure POC ==== 1-visit https://██████//██████████ 2-go to query and search for admin then execute 3-go to this endpoint to retrieve the information...

LY Corporation: Theft of arbitrary files in LINE Lite client for Android

Due to one of the exported activitiescom.linecorp.linelite.ui.android.share.SelectShareActivity of LINE Lite client for Android before 2.17.0 not verifying the URI sent by a third-party application installed on the user device, the application with some interaction of the user would be able to...