69 matches found
CVE-2023-41161
Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...
SAP Application Interface Framework 跨站脚本漏洞
SAP Application Interface Framework SAP AIF is an application interface framework from SAP, Germany. A security vulnerability exists in SAP Application Interface Framework ODATA service versions 600 and 700, which allows an authorized attacker to enter a link or title with custom CSS classes into...
SUSE CVE-2016-5704
Cross-site scripting XSS vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment...
CVE-2022-4354
A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comment of the component Message Board. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has be...
CVE-2022-35500
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting XSS via leave comment functionality...
Backdrop CMS 跨站脚本漏洞
Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS Comment version 1.23.0, which can be exploited by attackers to launch cross-site scripting XSS attacks due to a lack of effective filtering and escaping of user-supplied data...
WordPress plugin wpDiscuz 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2022-24673 · M Files · M-Files Hubshare
Name of the Vulnerable Software and Affected Versions: M-Files Hubshare versions prior to 3.3.10.9 Description: The issue is related to improper input validation and output encoding in comments fields, allowing authenticated attackers to introduce cross-site scripting attacks via specially crafte...
GHSA-62WV-866C-RH86 Moodle does not properly restrict comment capabilities
comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...
WordPress Ark-commenteditor plugin <= 2.15.6 - Iframe Injection via Comment vulnerability
Iframe Injection via Comment vulnerability discovered by Rasi Afeef in WordPress Ark-commenteditor plugin versions = 2.15.6. Solution Deactivate and delete. This plugin has been closed as of September 23, 2021 and is not available for download. Reason: Security Issue...
CVE-2019-16954
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
Munkireport comment cross-site scripting vulnerability
Munkireport is a reporting tool for the Munki software management program. comment is one of the comment modules. A cross-site scripting vulnerability exists in MunkiReport for comments prior to version 4.0. A remote attacker can exploit this vulnerability by posting a new comment to inject...
DEBIAN-CVE-2010-1673
A cross-site scripting XSS vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment...
CVE-2010-1673
A cross-site scripting XSS vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-9881
The WPGraphQL 0.2.3 plugin for WordPress contains an Access Control Error vulnerability (CWE-306) in its createComment mutation. This flaw allows unauthenticated users to post comments on any article, bypassing the "allow comment" restriction. Successful exploitation can lead to content manipulat...
WordPress WPGraphQL Access Control Error Vulnerability
WPGraphQL is a free open source WordPress plugin that provides an extensible GraphQL architecture and API for any WordPress site. WordPress WPGraphQL suffers from an Access Control Error vulnerability that can be exploited by an attacker to post a comment on any post...
XSS Vulnerability at JEESNS Microblog Comments
JEESNS is an open source social management system developed on the JAVA enterprise level platform. JEESNS microblogging comments at the existence of XSS vulnerability , an attacker can use the vulnerability to inject arbitrary Web script or HTML...