110 matches found
CVE-2022-42000: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage...
CVE-2022-1663
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
Cross site request forgery (csrf)
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
CVE-2022-1663 Stop Spam Comments <= 0.2.1.2 - Access Token Bypass
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
Stop Spam Comments <= 0.2.1.2 - Access Token Bypass
The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. PoC Collect the name and value of ssckey for the target post and use it on the request. curl...
CVE-2022-31298
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...
CVE-2022-31298
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...
Cross site scripting
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...
CVE-2022-31298: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...
PT-2022-20673
Name of the Vulnerable Software and Affected Versions Haraj version 3.7 Description A cross-site scripting issue in the ads comment section allows attackers to execute arbitrary web scripts or HTML via a crafted POST request. Recommendations For Haraj version 3.7, consider disabling the ads comme...
PT-2022-9493 · WordPress · Stars Rating Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: The Stars Rating WordPress plugin versions prior to 3.5.1 Description: The issue allows submission of a long integer, causing a Denial of Service in the comments section or pending comment dashboard, depending on whether the user sent it as...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Weibo comment section...
PT-2021-10608
Name of the Vulnerable Software and Affected Versions: ZrLog version 2.1.3 Description: A Cross-site scripting XSS vulnerability exists in the comment section, which allows remote attackers to inject arbitrary web script and steal administrator cookies via the nickname parameter, gaining access t...
CVE-2021-21544
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user...
CVE-2021-21544: Client-Side Enforcement of Server-Side Security
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user...
Cross-site Scripting (XSS)
xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...
Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
GHSA-43HG-G44Q-474Q Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...