7925 matches found
CVE-2023-2986
Prueba de Concepto Original para CVE-2023-2986 Prueba de Concepto para la vulnerabilidad CVE-2023-2986 en el plugin 'Abandoned Cart Lite for WooCommerce' de WordPress Detalles Relacionados Enlace NVD : https://nvd.nist.gov/vuln/detail/CVE-2023-2986 Fuente del Plugin :...
WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...
CVE-2026-78080
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...
EUVD-2026-70452
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...
CVE-2026-78080
CVE-2026-78080 affects the JooDatabase Lite Joomla extension (feenders.de), versions below 5.1.0 . The root cause is the cid parameter being used in database queries without input validation, enabling an unauthenticated SQL injection attack over the network with low complexity and no user interac...
CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
Malicious code in firestore-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...
MAL-2026-15534 Malicious code in firestore-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...
Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
MAL-2026-15491 Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
MAL-2026-15489 Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed0e447cd98b9470a197c1dd9b341e6a93ea6f39088f4f93335979827f707b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed0e447cd98b9470a197c1dd9b341e6a93ea6f39088f4f93335979827f707b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-78138
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
WordPress Finale Lite plugin < 2.21.0 - Subscriber+ Campaign Configuration Disclosure vulnerability
Subscriber+ Campaign Configuration Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Finale Lite versions 2.21.0...
EUVD-2026-66883
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
CVE-2026-78138
CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions
MAL-2026-15729 Malicious code in micro-lite-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...