Luigi Gubello

The issue allows for cross-site scripting (XSS) via an event attribute and arbitrary file loading via a src attribute. This can occur if the application has the READ EXTERNAL STORAGE permission.

The issue allows for cross-site scripting (XSS) via an event attribute and arbitrary file loading via a src attribute, provided the application has the READ EXTERNAL STORAGE permission.

The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission.

The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission.

The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission.

The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission.

A vulnerability exists where opening a locally saved HTML file can allow access to other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may be uploaded to a server. This issue can be exploited in combination with a popular Android messaging app to read attachments the victim received from other correspondents.

An issue was discovered related to the default Parental Control PIN. If the PIN of the page "/ui/cbpc/login" is the default (0000), it is possible to bypass the login form by editing the path of the cookie `sid` generated by the page. This allows an attacker to access the router control panel with administrator privileges. The vulnerability is associated with the use of the predefined PIN code and can be exploited by a remote attacker to bypass authentication and gain access to the router's control panel with administrator privileges.

The issue is related to stored XSS via the `Name` field.

The issue allows for XSS via the `mapTitle` parameter in the Google Maps miniature within the events-manager.js file.

The issue concerns a cross-site scripting (XSS) flaw. It is triggered by a jQuery.ajax request to the `ng-payment details dialog.js` file.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the `tab` parameter in the `gdbbpress attachments` page to `wp-admin/edit.php`.

The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. (dot dot) in the `tab` parameter in the "gdbbpress attachments" page to "wp-admin/edit.php".