CVE-2021-39473

CVE-2021-39473 Affected Product Code Base HotelManager - v1.2 Affected Component Kernel.php; Middleware Attack Type Remote Attack Vectors To exploit this vulnerability the user needs to create "rooms" or "guests" or "reservations" or "users" and in the "comment" or "contact" field can execute a x...

YT-Spammer-Purge

YouTube Spammer Purge What Is This? - Allows you to filter and search for spammer comments on your channel and other's channels in many different ways AND delete/report them all at once see features below. How to Download: Click the "Releases" link on the right, then on the latest release, under...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...

npm: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

npm: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.12...

GHSA-QRH6-CWG3-343X Ghost: Authorization Bypass in Comment Like Feature

Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using...

Ghost: Authorization Bypass in Comment Like Feature

Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using...

npm: Ghost: Authorization Bypass in Comment Like Feature

npm: Ghost: Authorization Bypass in Comment Like Feature vulnerability discovered by ? in WordPress npm ghost versions = 5.9.0, 6.44.1...

EUVD-2026-90681

Ghost: Authorization Bypass in Comment Like Feature...

CVE-2025-29775

SAMLStorm CVE-2025-29775 Lab Environment This is a lab environment for demonstrating the SAMLStorm vulnerability CVE-2025-29775 that affects the xml-crypto library and SAML implementations in Node.js. Note: This is not a true exploitation of the vulnerability, just a recreation to demonstrate how...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense Notice This is a project by Sijia Zhanghttps://github.com/sijiahi and Bowen Zhouhttps://github.com/KonjakZhou Prerequisite: 1 Recurrence Attack: - Configure and install Wordpress5.0 under http://localhost/wp-admin/; - Log in Wordpress as admin, post at least one...

CVE-2022-42097

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Comment . Attack Vectors: The attacker must post something on the "comment" and insert the XSS payload at the "comment" input, and...

KPOT-string-decrypter

KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage .\ExportDump dllpath e.g. .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done...

CVE-2026-109995

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109995 Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109995

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress (versions up to and including 3.9.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter. An unauthenticated att...

EUVD-2026-110755

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-5024

Exploit Title: PLANNO 23.04.04 COMMENT CROSS SITE SCRIPTING Exploit Author: Angel Metz AKA PH03N1XSP Vendor Homepage: Planno Software Link: GitHub - PlanningBiblio Version: alert1; 4. Once the script is entered, proceed to obtain the reflected XSS. 2nd Path 1. Proceed to log in using your...