4030 matches found
CVE-2020-36505
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery CSRF checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog...
All Vulnerabilities for insidende.education.ne.gov Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| insidende.education.ne.gov ---|--- Open...
CVE-2021-24543
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue...
Cross site scripting
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue...
CVE-2021-24543 jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue...
CVE-2021-24543
CVE-2021-24543 corresponds to the WordPress plugin jQuery Reply to Comment (versions
PT-2021-16063 · WordPress · Jquery Reply To Comment
Name of the Vulnerable Software and Affected Versions: jQuery Reply to Comment WordPress plugin versions 1.31 and earlier Description: The issue concerns a Stored Cross-Site Scripting problem. It arises because the plugin lacks a CSRF check when saving its settings and does not properly sanitise ...
WordPress plugin jQuery Reply to Comment 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2020-23048
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting XSS vulnerability in the component AddEvent.php via the name and comment parameters...
SeedDMS 跨站脚本漏洞
SeedDMS is a free document management system with an easy-to-use web-based user interface. A cross-site scripting vulnerability exists in the AddEvent.php component in SeedDMS version 6.0.7. The vulnerability can be exploited to inject malicious script code via the name and comment parameters...
Delta Electronics DiaLink 跨站脚本漏洞
DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...
Design/Logic Flaw
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...
WordPress wpDiscuz plugin <= 7.3.3 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Comment Addition/Edition/Deletion
Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Comment Addition/Edition/Deletion discovered by Brandon Roldan in WordPress wpDiscuz plugin versions = 7.3.3. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.3.4...
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...
WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by John Castro Pagely in WordPress Comment Engine Pro plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of October 7, 2021 and is not available for download. Reason: Security Issue...
The vulnerability of CKEditor’s WYSIWYG editor, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise data integrity.
The vulnerability of the CKEditor WYSIWYG editor is related to the incorrect processing of the “--!” comment. Exploiting this vulnerability may allow an attacker to compromise the integrity of the data...
CVE-2020-21013
emlog v6.0.0 contains a SQL injection via /admin/comment.php...