Threats affecting pkg:bitnami/brotli

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.