CVE-2023-41623

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...

CVE-2023-41623

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...

CVE-2023-41623: Improper Neutralization of Special Elements used in an SQL Command

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...

Education Time Indonesian School CRM 1.7 SQL Injection

==================================================================================================================================== | Title : Education Time Indonesian School CRM v 1.7 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozill...

PT-2023-18861

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue is related to an arbitrary file deletion vulnerability. It affects the component /include/inc content media.php. Recommendations For bloofoxCMS version 0.5.2.1, consider restricting access to th...

PT-2021-7901

Name of the Vulnerable Software and Affected Versions DedeCMS version 7.5 SP2 Description The issue is related to the lack of protection measures for the web page structure in the select media.php component of the DedeCMS content management system. This can be exploited by a remote attacker to...

Information Disclosure

Wordpress is vulnerable to Information Disclosure. The vulnerability exists in the wpprepareattachmentforjs function in media.php where a remote attacker can modify the parameter authorname as part of a request to /wp-json/oembed/1.0/embed?url which would lead to path disclosure...

sjelesorgogveiledning.no XSS vulnerability

Open Bug Bounty ID: OBB-639582 Description| Value ---|--- Affected Website:| sjelesorgogveiledning.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

duluthgospeltab.org XSS vulnerability

Open Bug Bounty ID: OBB-613483 Description| Value ---|--- Affected Website:| duluthgospeltab.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ebchurch.net XSS vulnerability

Open Bug Bounty ID: OBB-611011 Description| Value ---|--- Affected Website:| ebchurch.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-6814

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2017-6814: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2016-7168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the mediahandleupload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

PT-2016-7864

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.11 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media title parameter in admin/media.php and admin/media item.php...

CVE-2016-9891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

PT-2016-6972

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.10 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the media manager. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the q and...