7902 matches found
Cross site request forgery (csrf)
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
CVE-2019-14679
CVE-2019-14679 concerns the ARPrice Lite WordPress plugin (version 2.2) where core/views/arprice_import_export.php is vulnerable to CSRF via wp-admin/admin.php?page=arplite_import_export. The issue could allow an authenticated user to trigger unintended actions on that page. CVSS details indicate...
CVE-2019-14679
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
WordPress MapSVG Lite Plugin Cross Site Request Forgery (CVE-2019-1000003)
A cross site request forgery vulnerability exists in WordPress MapSVG Lite plugin. Successful exploitation of this vulnerability can result in the execution of arbitrary code in the effected system...
WordPress Newsletter Lite plugin <= 4.6.16 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Newsletter Lite plugin versions = 4.6.16. Solution Update the WordPress Newsletter Lite plugin to the latest available version at least 4.6.18...
Newsletter Lite < 4.6.19 - Multiple Issues
- Lack of CSRF, Authorisation and sanitisation checks in the ajaxloadneweditor function, registered as an AJAX method, can lead to an authenticated reflected XSS issue. - Authenticated Directory Traversal leading to RCE XSS: As an authenticated user with a role as low as a Subscriber, open...
Newsletter Lite < 4.6.19 - Multiple Issues
- Lack of CSRF, Authorisation and sanitisation checks in the ajaxloadneweditor function, registered as an AJAX method, can lead to an authenticated reflected XSS issue. - Authenticated Directory Traversal leading to RCE PoC XSS: As an authenticated user with a role as low as a Subscriber, open...
CVE-2017-9388
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific...
Wordpress Plugin Cart66 Lite DatabaseSQL Backup Leakage Vulnerability
WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. An attacker backup disclosure vulnerability exists in the Wordpress plugin Cart66 Lite...
WordPress Finale Lite plugin <= 2.9.0 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability found in WordPress Finale Lite plugin versions = 2.9.0. Solution Update the WordPress Finale Lite plugin to the latest available version at least 2.9.1...
IP Address Blocker <= 10.3 - CSRF leading to Arbitrary File Upload
The LionScripts: IP Blocker Lite WordPress plugin was affected by a CSRF leading to Arbitrary File Upload security vulnerability...
SQL Injection Vulnerability in Lite-On's Website Building System
Lide Technology is a company engaged in computer and peripheral sale and maintenance, printer sale and lease maintenance, website setup, software information development, large picture printing and output. A SQL injection vulnerability exists in Lite-On's website builder system, which can be...
CVE-2019-5286
There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007...
CVE-2019-5286
There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007...
CVE-2019-5286
There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007...
Huawei HedEx Lite Cross-Site Scripting Vulnerability (CNVD-2019-17140)
Huawei HedEx Lite is a product document manager from Huawei China. The product supports the functions of downloading, managing and reading product documents. A cross-site scripting vulnerability exists in versions prior to Huawei HedEx Lite V200R006C00SPC007. The vulnerability stems from the lack...
CVE-2018-5265
Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters...
Finale WooCommerce Sale Countdown <= 2.9.0 - Arbitrary File Upload
The Finale Lite – Sales Countdown Timer & Discount for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
