187 matches found
CVE-2021-44935: Origin Validation Error
glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /publichtml/comment.php. The attacker can complete the attack remotely without interaction...
CVE-2020-21013
emlog v6.0.0 contains a SQL injection via /admin/comment.php...
CVE-2020-21013
CVE-2020-21013 affects the Emlog CMS (version 6.0.0). The vulnerability is a SQL injection in the admin/comment.php component, arising from improper handling of user-controlled input. Impact is reported as potential exposure of sensitive data (information disclosure) and partial integrity/availab...
CVE-2020-21013: Improper Neutralization of Special Elements used in an SQL Command
emlog v6.0.0 contains a SQL injection via /admin/comment.php...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-comment.php by adding a question mark ? followed by the payload...
Cross site scripting
Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...
CVE-2020-10467
CVE-2020-10467 corresponds to a reflected XSS in Chadha PHPKB Standard Multi-Language 9. The vulnerability arises in admin/edit-comment.php via the GET parameter p, allowing injection of arbitrary script/HTML. Affected software: Chadha PHPKB Standard Multi-Language version 9. Underlying issue: in...
CVE-2020-10403: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-comment.php by adding a question mark ? followed by the payload...
CVE-2020-10467: Improper Neutralization of Input During Web Page Generation
Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...
e107_admin/comment.php file cross-site scripting vulnerability
e107 is an open source, free and PHP and MySQL based Content Management System CMS from the e107 team. A cross-site scripting vulnerability exists in the e107admin/comment.php file in e107 v2.1.9. The vulnerability stems from the WEB application lacking proper validation of client-side data. An...
CVE-2018-17423
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-17423
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
Design/Logic Flaw
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-17423
CVE-2018-17423 affects e107 v2.1.9 with a cross-site scripting (XSS) vulnerability in e107_admin/comment.php due to improper validation of client-side data. Documents from NVD, Red Hat, CNVD, OSV, OpenVAS and others corroborate the XSS flaw; exploitation details or fixes are not provided in the a...
CVE-2018-17423
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-17423: Improper Neutralization of Input During Web Page Generation
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
CVE-2019-9787: Cross-Site Request Forgery (CSRF)
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
yiqicms Cross-Site Scripting Vulnerability
yiqicms is a content management system CMS for marketing enterprise websites. A cross-site scripting vulnerability exists in the comment.php file in yiqicms 2016-11-20 and earlier versions, which stems from the program only applying a length restriction to $msgtitle, which can be exploited by a...