7 matches found
CVE-2026-12142 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
PT-2026-54618
Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the name array...
CVE-2020-10249
BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...
LibOSDP code-related vulnerabilities
LibOSDP is a goToMain open source cross-platform open source implementation of the IEC 60839-11-5 Open Surveillance Device Protocol. Designed to improve interoperability between access control and security products. A code issue vulnerability exists in LibOSDP versions prior to 2.4.0 that stems...
CVE-2020-10249
BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to valsoft.php3...
PT-2020-12005
Name of the Vulnerable Software and Affected Versions BWA DiREX-Pro version 1.2181 Description The issue allows full path disclosure via an invalid name array parameter to the "val soft.php3" API endpoint. Recommendations For BWA DiREX-Pro version 1.2181, consider restricting access to the "val...
