CVE-2021-24630: Improper Neutralization of Special Elements used in an SQL Command

The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author...

PT-2021-16146

Name of the Vulnerable Software and Affected Versions Schreikasten WordPress plugin versions prior to 0.14.19 Description The issue concerns the Schreikasten WordPress plugin, where the id GET parameter is not properly sanitized or escaped before being used in SQL statements. This can lead to...

CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments...

Lightbeed Akka Akka-http缓冲区错误漏洞

Lightbeed Akka Akka-http is a toolkit from the Lightbeed community in China. It provides a more generalized toolkit for providing and using HTTP-based services. A buffer error vulnerability exists in Akka HTTP, which allows an attacker to conduct a denial of service attack by sending a User-Agent...

CVE-2020-36505

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery CSRF checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog...

Cross site request forgery (csrf)

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery CSRF checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog...

CVE-2020-36505: Cross-Site Request Forgery (CSRF)

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery CSRF checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog...

PT-2021-12073

Name of the Vulnerable Software and Affected Versions: Delete All Comments Easily WordPress plugin versions 1.3 and earlier Description: The issue is related to a lack of Cross-Site Request Forgery CSRF checks in the plugin. This could allow an unauthenticated attacker to make a logged-in admin...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Delete All Comments Easily plugin in version 1.3 and earlier is vulnerable to cross-site request forgery, which can ...

Cross-Site Request Forgery (CSRF) in microweber/microweber

Description Hello Microweber team I found a CSRF on deleting the comments : //PoC.html history.pushState'', '', '/' after you run this PoC.html you can see that the comment with id 1 will be deleted...

Cross-Site Scripting (XSS)

camaleoncms is vulnerable to cross-site scripting. The library does not properly sanitize the post's comment section, allowing malicious users to inject and execute malicious javascript...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS by allowing unprivileged application users to store malicious scripts in the comments sectio...

CVE-2021-25969

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

CVE-2021-25969

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

CVE-2021-25969

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

CVE-2021-25969 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

CVE-2021-25969 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

PT-2021-16893

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 0.0.1 through 2.6.0 Description The issue allows an unauthenticated attacker or unprivileged application users to store malicious scripts in the comments section of a post. These scripts are executed in a victim's browser...

CVE-2021-25969: Improper Neutralization of Input During Web Page Generation

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

in microweber/microweber

Description For comments when the captcha is enable, the attacker can send many spam comments only with first correct captcha code, this means attacker only one time enter the captcha and then can use it for many many times and make damage on availability of system...