4589 matches found
Generic Secret Disclosure
Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private services will require authentication like API and private keys, username and password based credentials and similar sensitive data. Developers sometimes hard...
WooDiscuz – WooCommerce Comments <= 2.3.0 - Cross-Site Request Forgery
Description The WooDiscuz – WooCommerce Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform a...
CVE-2023-28876
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...
CVE-2023-28876
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...
CVE-2023-28876
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...
Improper access control
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...
CVE-2023-28876
The CVE-2023-28876 issue affects Filerun up to Update 20220202, describing a Broken Access Control in comments on uploaded files that allows an attacker to delete comments on files uploaded by other users. The available connected records confirm the affected product (Filerun) and the impact on co...
Afian FileRun security vulnerability
Afian FileRun is a full-featured web-based file manager. A security vulnerability exists in Afian FileRun that stems from the presence of a corrupted access control issue that allows an attacker to delete comments on files uploaded by other users...
CVE-2023-28876: Undefined Security Weakness
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...
WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software WooDiscuz – WooCommerce Comments Type Plugin Vulnerable versions = 2.3.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49759 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f67f1f9aa58c Credits...
CVE-2023-47437
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting XSS attack. The vulnerability exists due to inadequate input validation in the Project Description and comments, which enables an attacker to inject malicious java script...
Pachno Cross-Site Scripting Vulnerability
Pachno is an open source platform for collaboration from Pachno Open Source. A cross-site scripting vulnerability exists in Pachno version 1.0.6, which stems from insufficient validation of inputs in project descriptions and comments, allowing an attacker to inject malicious java script...
CVE-2023-47437: Improper Neutralization of Input During Web Page Generation
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting XSS attack. The vulnerability exists due to inadequate input validation in the Project Description and comments, which enables an attacker to inject malicious java script...
Cross Site Scripting (XSS)
DOMSanitizer is vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to improper sanitization of HTML comments in DOMSanitizer.php. This could allow an attacker to inject malicious code via a HTML comment...
Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Comments Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
Design/Logic Flaw
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...