Reflected-XSS-on-Opentext-Portal-v7.4.4

OpenText Portal v7.4.4 中的跨站脚本（XSS）漏洞允许远程攻击者通过 vgnextoid URI 参数注入任意 web 脚本或 HTML 代码。 攻击向量：在 vgnextoid 参数中，以 "--"（HTML 注释结束序列）前缀的 JavaScript 注入 结果： 由 Héctor Sainz 发现...

CVE-2023-31779

CVE-2023-31779 XSS Almacenado en Wekan Descripción : Existe una vulnerabilidad de XSS almacenado en la función "Reacción al comentario". Un atacante con privilegios de usuario en el tablero kanban puede ejecutar código JavaScript en los navegadores de los usuarios que abran una tarjeta con una...

CVE-2022-42097

Backdrop CMS 版本 1.23.0 漏洞说明： Backdrop CMS 版本 1.23.0 被发现存在一个存储型跨站脚本（XSS）漏洞，通过 Comment 功能。 攻击向量： 攻击者必须在"评论"上发布内容，并在"评论"输入框中插入XSS载荷，然后选择原始HTML编辑器以利用存储型XSS。保存后XSS载荷将立即触发。 受影响： http://ipaddress/backdrop/comment/reply/idreply POST /backdrop/comment/reply/idreply 载荷： 测试环境： 1. Backdrop CMS 版本 1.23.0...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

solidity_CVE-2021-42574-POC

solidityCVE-2021-42574-POC 31 ene 2023, Altin tin-z, github.com/tin-z PoC POC de CVE-2021-42574 para solidity y el compilador solc. instalar solc and select 0.8.17 version https://github.com/crytic/solc-select foundry https://github.com/foundry-rs/foundry desplegar contrato SOLV=0.8.17...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Resumen PoC de CVE-2019-9787 CSRF WordPress versión 5.0 referencia No uses esto excepto con fines de prueba. Instalación $ docker-compose up -d 1. accede a http://localhost:8080/ e instala WordPress. Solo tienes que crear una cuenta de administrador de WP. 2. accede a...

Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion

A directory traversal vulnerability in the ZiMB Comment comzimbcomment component 0.8.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1602 info: name: Joomla! Component...

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...

Advanced Comment System 1.0 - Local File Inclusion

ACS Advanced Comment System 1.0 is affected by local file inclusion via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. id: CVE-2020-35598 info: name: Advanced Comment System 1.0 - Local File Inclusion author: daffainfo severity: high description: ACS Advanced Comment System 1.0 is affect...

CVE-2009-4623

CVE-2009-4623 Sistema de Comentarios Avanzado 1.0 Reverse Shell Múltiples vulnerabilidades de inclusión remota de archivos PHP en Advanced Comment System 1.0 permiten a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro ACSpath hacia 1 index.php y 2 admin.php en...

TrojanSourceFinder

TrojanSourceFinder TrojanSourceFinder 帮助开发者检测源代码中的"特洛伊木马源"漏洞。 特洛伊木马源漏洞允许攻击者让恶意代码看起来无害。 通常，攻击者通过将代码伪装成注释（视觉上）来诱骗受害者。这是一个严重的威胁，因为它影响许多语言。包含多个"不可信"来源的项目可能受到影响。 检测恶意 🔎 · 追踪恶意 👀 · 特洛伊木马源 ❓ 安装 使用 go 通过 go install go install github.com/ariary/TrojanSourceFinder/cmd/tsfinder@latest 确保 $GOPATH 在 $PATH 中...

CVE-2025-29775

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

CVE-2022-35500

CVE-2022-35500 Cross-Site Scripting XSS almacenado en la funcionalidad de dejar comentarios en Amasty Blog Pro para Magento 2 Descripción La funcionalidad de dejar comentarios en el plugin Amasty Blog Pro 2.10.3 y 2.10.4 para Magento 2 permite la inyección de código JavaScript en la mutación...

CVE-2026-95112

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

CVE-2026-95112

The Gitea application is vulnerable to CPU exhaustion when processing issue and comment bodies. The root cause is that the system scans the entire preceding text for action keywords like "closes" or "fixes" once for every Markdown link , resulting in processing time that is quadratic relative to ...

YT-Spammer-Purge

YouTube Spammer Purge 这是什么？ - 允许你通过多种方式过滤和搜索你频道（以及其他人的频道）上的垃圾评论，并一次性删除/举报它们（详见下方功能）。 如何下载： 点击右侧的 "Releases" 链接，然后在最新版本下，点击 'Assets' 下的 "YTSpammerPurge.exe" 进行下载。（你可能需要点击 "Assets" 才能查看该版本的下载文件） Linux 安装说明 MacOS 安装说明 （如果使用 exe 文件，则无需在 Windows 上安装。但请参见此页面了解如何设置所需的 API 密钥） 详细信息和文档 → 请访问 Wiki 点击此处...

CVE-2026-66666 WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

CVE-2026-66666 WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

CVE-2026-66666

This vulnerability in WordPress Core (versions through 7.1.2 ) allows for the unauthenticated exposure of sensitive data , specifically comments on private and unpublished posts . The flaw is categorized as an Insertion of Sensitive Information Into Sent Data (CWE-201) via the Comment Feed functi...

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability discovered by Ananda Dhakal Patchstack in WordPress core versions = 7.1.2...