Ngô Thiên An

Name of the Vulnerable Software and Affected Versions: EventON versions n/a through 2.3.2 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of vulnerability where an attacker can manipulate the filename used in include or require statements, potentially allowing them to execute malicious code. Recommendations: For versions n/a through 2.3.2, update to a version later than 2.3.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: AREOI All Bootstrap Blocks versions 1.3.19 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File Inclusion. Recommendations: For versions 1.3.19 and earlier, update to a version that fixes this issue, as the current version allows for PHP Local File Inclusion due to improper control of filenames in include/require statements. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored XSS. This means that an attacker can inject malicious code into the web page, potentially affecting users who access the page.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion. This could potentially lead to system compromise.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. A Cross Site Scripting (XSS) vulnerability exists in the WP Delicious Delicious Recipes – WordPress Recipe Plugin.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored Cross-site Scripting (XSS). This is a type of security vulnerability that occurs when an application includes user input in its output without proper validation or sanitization, enabling an attacker to inject malicious scripts into the website.

The issue is related to Stored Cross-Site Scripting via the `carousel direction` parameter of the testimonials widget. This is due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS. This means that an attacker can inject malicious code into the website, which will be stored and executed when other users access the site.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS. This means that an attacker can inject malicious code into a website, potentially affecting users who visit the site.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping on user-supplied attributes like `title tag`. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via block ids due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

Name of the Vulnerable Software and Affected Versions: SiteOrigin Widgets Bundle plugin for WordPress versions up to, and including, 1.62.2 Description: The issue is related to Stored Cross-Site Scripting via the Image Grid widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 1.62.2, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the Image Grid widget for users with contributor-level access and above until a patch is available.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, which can be exploited.

The issue is related to Stored Cross-Site Scripting via the plugin's Sharing block due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.