WordPress Delete All Comments of wordpress plugin <= 4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Delete All Comments of wordpress plugin versions = 4.2. Solution Update the WordPress Delete All Comments of wordpress plugin to the latest available version at least 4.3...

WordPress Delete All Comments of wordpress plugin <= 4.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Delete All Comments of wordpress plugin versions = 4.2. Solution Update the WordPress Delete All Comments of wordpress plugin to the latest available version at least 4.3...

WordPress Comments Not Replied To plugin < 1.5.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Comments Not Replied To plugin versions 1.5.2. Solution Update the WordPress Comments Not Replied To plugin to the latest available version at least 1.5.2...

WordPress Comments Not Replied To plugin < 1.5.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Comments Not Replied To plugin versions 1.5.2. Solution Update the WordPress Comments Not Replied To plugin to the latest available version at least 1.5.2...

GitLab Enterprise Edition和GitLab Community Edition 资源管理错误漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A resource management error vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition, which arises from user-supplied input in user...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Ultimate CSV Importer plugin prior to 6.4.3...

WordPress Better Comments plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Better Comments plugin versions = 1.3. Solution Update the WordPress Better Comments plugin to the latest available version at least 1.4...

PT-2022-13125 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer WordPress plugin versions prior to 6.4.3 Description: The issue allows high privilege users to import malicious comments, potentially leading to Stored Cross-Site Scripting issues, due to the lack of sanitization and...

WordPress Internal Comments plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Internal Comments plugin versions = 1.2.2. Solution Update the WordPress Internal Comments plugin to the latest available version at least 1.2.3...

CVE-2022-0360: Improper Neutralization of Input During Web Page Generation

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

WordPress Better Comments plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Better Comments plugin versions = 1.3. Solution Update the WordPress Better Comments plugin to the latest available version at least 1.4...

PeerTube licensing issue vulnerability

PeerTube is a decentralized video sharing service platform. It is used to create video projects. versions of PeerTube prior to 4.1.0 contain an authorization issue vulnerability that can be exploited by attackers to create new comments or reply to comments in private videos...

IERC4626RouterBase - withdraw - slippage does not work

Lines of code Vulnerability details Impact The router does not have the intended behavior: according to the EIP , withdraw burn shares to withdraw exactly assets, so the slippage protection should protect the user from burning too many shares. Furthermore, comments in the interface are incorrect ...

CVE-2022-0279

The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Shield Security plugin version 13.0.6 previously had a cross-site scripting vulnerability, whic...

Improper Access Control in liangliangyy/djangoblog

Description "formvalid" function in comments/views.py file performs the task of saving user comments. However, this function doesn't check the status of article, so users can leave comments on draft article or public article with commentstatus is off. Proof of Concept - Step 1: Login as admin in...

in microweber/microweber

Description Sensitive information as part of the error is getting disclosed while viewing comments from "loadmodule:commentssearch=" Proof of Concept 1. Login to https://demo.microweber.org 2. Visit https://demo.microweber.org/demo/admin/view:modules/loadmodule:commentssearch= 3. Now enter anythi...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

Cross site scripting

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...