CVE-2022-39950

An improper neutralization of input during web page generation vulnerability CWE-79 exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via...

PT-2022-1389 · Fortinet · Fortianalyzer +1

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.0.0 through 7.0.4 FortiAnalyzer versions 6.0.0 through 7.0.4 Description: The issue is related to an improper neutralization of input during web page generation, which may allow a low privilege level attacker to perfor...

M-Files Hubshare 跨站脚本漏洞

M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare versions prior to 3.3.10.9, which stems from incorrect input validation and output encoding of all of its...

PT-2022-24673 · M Files · M-Files Hubshare

Name of the Vulnerable Software and Affected Versions: M-Files Hubshare versions prior to 3.3.10.9 Description: The issue is related to improper input validation and output encoding in comments fields, allowing authenticated attackers to introduce cross-site scripting attacks via specially crafte...

WordPress 4.8.x < 4.8.21 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...

WordPress 5.1.x < 5.1.15 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...

WP < 6.0.3 - Stored XSS via Comment Editing

Description WordPress does not properly escape comments, which could lead to Stored Cross-Site Scripting issues...

WordPress core <= 6.0.2 - Stored Cross-Site Scripting (XSS) vulnerability in Comment editing

Stored Cross-Site Scripting XSS vulnerability in Comment editing discovered by Alex Concha WordPress security team in WordPress core versions = 6.0.2 Solution Update the WordPress to the latest available version at least 6.0.3...

Cross-site Scripting (XSS)

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient escaping and sanitization of the values stored during a comment update. An attacker can execute malicious...

SQL Injection

modsecurity-crs:sid is vulnerable to SQL injection. An authenticated attacker is able to inject and execute arbitrary SQL commands in the database through comment characters and variable assignments in the SQL syntax...

CVE-2022-3220

The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-3220

The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress plugin Advanced Comment Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. versions prior to WordPress Advanced Comment Form 1.2.1 have a cross-site scripting vulnerability that stems...

CVE-2022-3220 Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSS

The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-3220: Improper Neutralization of Input During Web Page Generation

The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-36830

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Comment Guestbook plugin = 0.8.0 at WordPress...

CVE-2021-36830

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Comment Guestbook plugin = 0.8.0 at WordPress...

Cross site scripting

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Comment Guestbook plugin = 0.8.0 at WordPress...

CVE-2021-36830

CVE-2021-36830 affects the WordPress Comment Guestbook plugin (versions

CVE-2021-36830 WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Comment Guestbook plugin = 0.8.0 at WordPress...