CVE-2022-1709 Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF

The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments either all, spam, or pending, allowing attackers to make a logged in admin delete comments via a CSRF attack...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2023-06863)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a cross-site scripting vulnerability that stems from incorrect input validation when handling HTML comment tags. The vulnerability can be exploited by an attacker to launch...

Mozilla Firefox 跨站脚本漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a cross-site scripting vulnerability that stems from incorrect input validation when handling HTML comment tags. The vulnerability can be exploited by an attacker to launch...

Cross-Site Scripting (XSS)

@angular/core is vulnerable to cross-site scripting. The vulnerability exists in few methods due to not escaping the comment text which allows an attacker to inject and execute arbitrary javascript...

CVE-2021-4231 Angular Comment cross site scripting

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

GHSA-VC4F-2G7F-PMQR MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment

A Cross-Site Scripting XSS vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment...

MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment

A Cross-Site Scripting XSS vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment...

Comments plugin Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...

CVE-2022-29640

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29638

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29640

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29638

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29638

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Publify Access Control Error Vulnerability

Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.8. The vulnerability stems from an access control error in draft mode, which could be exploited by an attacker to comment on articles in draft mode...

Cross-site Scripting (XSS)

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper validation of comments, which makes it possible for an attacker to inject an HTML code. PoC: Details Cross-si...

Improper Access Control

publifycore is vulnerable to improper access control. The vulnerability exists in notifyuserviaemail function in article.rb due to lack of validations in comment field which allows an attacker to view data and perform unauthorized actions...

Silverstripe CMS Arbitrary Code Execution

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized...

GHSA-52XR-WX26-9RFG GeniXCMS Cross-site Scripting (XSS)

GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator...

GeniXCMS Cross-site Scripting (XSS)

GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator...

GHSA-5HF2-7XF4-W3J6 GeniXCMS Cross-site Scripting

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...