CVE-2023-34961

Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting XSS vulnerability via the /feedback/comment field...

PT-2023-25077 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11.x up to 1.11.18 Description: A cross-site scripting XSS issue was found in the /feedback/comment field, allowing potential exploitation. Recommendations: For versions 1.11.x up to 1.11.18, update to a version later than...

CVE-2023-34961

Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting XSS vulnerability via the /feedback/comment field...

Chamilo LMS 跨站脚本漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo versions v1.11.x through v1.11.18,...

CVE-2023-34961: Improper Neutralization of Input During Web Page Generation

Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting XSS vulnerability via the /feedback/comment field...

CVE-2023-34961

CVE-2023-34961 affects Chamilo v1.11.x up to v1.11.18, with a cross-site scripting (XSS) vulnerability via the /feedback/comment field. The issue is documented across multiple sources (NVD, RH Red Hat, OSV, PT-2023-25077) and is associated with CVSS v3.1 base score 6.1 (Network, Low attack comple...

CVE-2023-34961

Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting XSS vulnerability via the /feedback/comment field...

CVE-2020-36697

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

Authorization

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

CVE-2020-36697 WP GDPR <= 2.1.1 - Missing Authorization Checks

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

CVE-2020-36697 WP GDPR <= 2.1.1 - Missing Authorization Checks

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

CVE-2020-36697: Missing Authorization

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

PT-2023-11839 · WordPress · Wp Gdpr

Name of the Vulnerable Software and Affected Versions: WP GDPR plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to authorization bypass due to a missing capability check. This allows unauthenticated attackers to delete any comment and modify the plugin's...

CVE-2023-30948

A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's conten...

Palantir Foundry 安全漏洞

Palantir Foundry is a business process management platform from U.S.-based Palantir, Inc. A security vulnerability exists in Palantir Foundry versions prior to 2.249.0, which stems from a security flaw in the commenting functionality that can be exploited by an attacker to inject an attachment UU...

CVE-2023-1661: Improper Neutralization of Input During Web Page Generation

The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Leantime Systems Leantime 跨站脚本漏洞

Leantime Systems Leantime is an open source project management system based on PHP and MySQL from Leantime Systems. A security vulnerability exists in Leantime 2.3.21 and later versions, which can be exploited by users with comment privileges to inject malicious Javascript into a comment, which c...

Markdown injection into github comment

Description Users can donate for builds by tipping [email protected]. There's a github action that will thank the user in a comment. The name is not sanitized and by using one such as the following, attackers can inject their own markdown into the comment. foo The "" breaks out of the context,...

CVE-2023-2922

A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file index.php of the component GET Parameter Handler. The manipulation of the argument msg leads to cross site scripting. It is possible to launch the attack...

CVE-2023-2922

A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file index.php of the component GET Parameter Handler. The manipulation of the argument msg leads to cross site scripting. It is possible to launch the attack...