PT-2026-84533

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description An unauthenticated SQL injection exists in the User Location plugin. The endpoints 'regions.json.php' and 'cities.json.php' fail to properly escape or bind the country and region GET parameters before...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the handling of the ip parameter in the UserLocation plugin's testIP.php process. An attacker can execute arbitrary JavaScript in the...

CVE-2026-34739

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the UserLocation plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars or any other output encoding. This allows an attacker to inject arbitrary HTM...

CVE-2026-34739 AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the UserLocation plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars or any other output encoding. This allows an attacker to inject arbitrary HTM...

EUVD-2023-35142

Malicious code in bioql PyPI...

New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up. "While the iOS implant delivery method closely mirror...

CVE-2023-31217

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in MyTechTalky User Location and IP plugin = 1.6 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

CVE-2023-30780

CVE-2023-30780 is a stored XSS vulnerability in the WordPress plugin “User IP and Location” by TheGuideX, affecting versions ≤ 2.2. The issue arises from improper handling of user-supplied input, enabling authenticated users with contributor or higher roles to inject script into stored content. I...

CVE-2023-30780 WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...