Threats affecting pkg:generic/vlc

A missing authorization vulnerability exists in Everestthemes Everest Backup up to version 2.3.15. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability does not affect confidentiality or availability but can cause integrity issues.

The Hotel Booking Lite plugin (up to version 2.5.1) contains an unrestricted file upload vulnerability that allows attackers with limited privileges to upload files with dangerous types, such as web shells, to the web server. This vulnerability can lead to complete compromise of the affected system.

A stored cross-site scripting (XSS) vulnerability exists in WP Go Maps up to version 10.1.10. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in IdeaBox Creations PowerPack Lite for Beaver Builder up to version 1.3.2. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be executed in the context of users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetTabs (jet-tabs) versions up to 2.3.5. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in HTMega HT Mega for Elementor versions up to 3.2.8. The flaw is due to improper neutralization of input during web page generation, which can lead to script injection. This vulnerability has a CVSS score of 6.5, indicating a medium severity impact.

A Path Traversal vulnerability exists in the Realtyna Organic IDX plugin for real-estate-listing-realtyna-wpl, affecting versions up to 5.5.0. This vulnerability allows an attacker with low privileges to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can disrupt availability.

A missing authorization vulnerability exists in HTMega HT Mega ht-mega-for-elementor versions up to 3.2.8. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to certain functionalities or data. The vulnerability has a CVSS v3.1 base score of 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no integrity or availability impact reported.

A missing authorization vulnerability exists in Webful Creations RepairBuddy computer-repair-shop software, allowing exploitation of incorrectly configured access control security levels. This affects versions up to 4.1236. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact, primarily involving unauthorized information disclosure without integrity or availability impact.

A missing authorization vulnerability exists in PublishPress Gutenberg Blocks (advanced-gutenberg) versions up to 3.7.6. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw can lead to unauthorized actions with limited privileges but does not impact confidentiality or availability.

A reflected Cross-site Scripting (XSS) vulnerability exists in thethemefoundry Make theme versions up to 1.10.10. This vulnerability allows improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of a user's browser.

A stored cross-site scripting (XSS) vulnerability exists in the hupe13 Extension for Leaflet Map through version 6.1.1. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts that execute in the context of affected users.

A stored cross-site scripting (XSS) vulnerability exists in myCred up to version 4.0.2 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability of the affected system. The CVSS score is 6.5 (medium severity). No patch or remediation information is currently provided.

A missing authorization vulnerability exists in WP Media Imagify plugin versions up to 2.3.4. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A Cross-Site Scripting (XSS) vulnerability exists in MapSVG (up to version 9.0.4) produced by PT Norther Lights. The flaw involves improper neutralization of script-related HTML tags, allowing code injection. This vulnerability has a medium severity score of 5.3 and does not require user interaction or privileges to exploit.

A vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. This affects versions up to and including 2.20.5. The vulnerability has a medium severity with a CVSS score of 5.3.

A missing authorization vulnerability exists in Liquid Web / StellarWP Event Tickets plugin up to version 5.31.0. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

A SQL Injection vulnerability (CWE-89) exists in myCred up to version 4.0.2, allowing an attacker with low privileges to perform blind SQL injection attacks remotely without user interaction. This vulnerability can lead to high confidentiality impact and low availability impact. The vulnerability is identified as CVE-2026-125811 with a CVSS 3.1 score of 8.5.

A Cross-Site Scripting (XSS) vulnerability exists in eLightUp Slim SEO up to version 4.11.5 due to improper neutralization of script-related HTML tags. This flaw allows code injection via crafted input that is not properly sanitized.