The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.

LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.

Tripp Lite PDUMH15AT 12.04.0053 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053.

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.

The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.

The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.

The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.

The events-manager plugin before 5.6 for WordPress has code injection.