PT-2021-20147

Name of the Vulnerable Software and Affected Versions OnyakTech Comments Pro version 3.8 Description An issue was discovered in CommentsService.ashx. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment...

PT-2021-16039

Name of the Vulnerable Software and Affected Versions The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2021.18 Description The issue allows high privilege users, such as admins, to set Cross-Site Scripting payloads in some settings, even when the...

CVE-2021-24551

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

CVE-2021-24551

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

CVE-2021-24551

CVE-2021-24551 affects the WordPress Edit Comments plugin (version

CVE-2021-24551: Improper Neutralization of Special Elements used in an SQL Command

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

PT-2021-16071

Name of the Vulnerable Software and Affected Versions Edit Comments WordPress plugin versions 0.3 and earlier Description The issue arises from the lack of sanitization, validation, or escaping of the jal edit comments GET parameter before its use in a SQL statement, leading to a SQL injection...

Wordpress Plugin Edit Comments SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. Wordpress Plugin Edit Comments suffers from a SQL...

CVE-2021-28001

A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting...

Textpattern CMS 跨站脚本漏洞

Textpattern Cms is a Php-based content management system from the Textpattern team. A security vulnerability in the Comments parameter in Textpattern CMS versions prior to 4.8.4 allows an attacker to execute arbitrary code via a specially crafted load entered in the URL field...

CVE-2021-28001: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting...

PT-2021-17707

Name of the Vulnerable Software and Affected Versions: Textpattern CMS version 4.8.4 Description: A cross-site scripting issue was discovered in the Comments parameter, allowing remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The issue is triggered by...

Basecamp: Privilege Escalation leads to trash other users comment without having admin rights.

Privilege Escalation leads to trash other users comment without having admin rights...

CVE-2020-20977

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

CVE-2020-20977

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

CVE-2020-20977

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

CVE-2020-20977

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

PT-2021-10564 · Ukcms · Ukcms

Name of the Vulnerable Software and Affected Versions: UK CMS version 1.1.10 Description: A stored cross site scripting XSS vulnerability in "index.php/legend/6.html" of UK CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section. Recommendations...

UK CMS 跨站脚本漏洞

Lingji Network Technology UKcms is a PHP-based content management system CMS from China's Lingji Network Technology. UK CMS suffers from a security vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload in the Comments section...

CVE-2020-20977: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...