5656 matches found
Stored XSS via Markdown Comment
Description Register one account on blog, if account was actived, it can be comment. \ We can commment with markdown.\ When another user clicks on the comment there may be an XSS alert. I git clone project and build with docker. Latest commit is: 07a1ded08eb4e0c6979f6aeebc35f3864ba250a7\ \ Proof ...
PT-2023-22088
Name of the Vulnerable Software and Affected Versions Goobi viewer core versions prior to 23.03 Description A cross-site scripting issue has been identified in the user comment feature of the Goobi viewer core. This allows an attacker to create a specially crafted comment that results in the...
CVE-2023-29015: Improper Neutralization of Input During Web Page Generation
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...
GHSA-3J93-7RF7-P7M6 thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...
CVE-2020-20521
Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter...
Cross site scripting
Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter...
CVE-2020-20521
Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter...
CVE-2020-20521
CVE-2020-20521 is a Cross Site Scripting vulnerability in KiteCMS v1.1 that enables a remote attacker to execute arbitrary code via the comment parameter. The CVSS v3.1 base score is 6.1 (Medium); attack vector Network, user interaction Required, with a Changed scope and Confidentiality/Integrity...
CVE-2020-20521: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter...
KiteCMS 跨站脚本漏洞
KiteCMS is a website CMS. A security vulnerability exists in KiteCMS v.1.1. An attacker exploited the vulnerability to execute arbitrary code via the comment parameter...
PT-2023-11554 · Kitecms · Kitecms
Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the comment parameter. Recommendations: For KiteCMS version 1.1, avoid using the comment parameter until a fix is available. ...
WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Comment Reply Notification Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25051 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fac19e90ec15 Credits Mika Require...
SUSE CVE-2021-33641
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free...
PT-2023-9824 · Gitlab · Gitlab Ce/Ee
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 17.6.0 Description: The issue is related to insufficient protection of service data when adding non-image attachments, resulting in a lack of authentication procedure. This allows a remote attacker to bypass...
CVE-2023-28154
A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a specially-crafted...
CVE-2023-27711
Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...
Cross site scripting
Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...
