CVE-2020-23048

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting XSS vulnerability in the component AddEvent.php via the name and comment parameters...

PT-2021-10824

Name of the Vulnerable Software and Affected Versions SeedDMS Content Management System version 6.0.7 Description The issue is a persistent cross-site scripting XSS vulnerability. It is located in the AddEvent.php component and can be exploited via the name and comment parameters. Recommendations...

CVE-2020-23048: Improper Neutralization of Input During Web Page Generation

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting XSS vulnerability in the component AddEvent.php via the name and comment parameters...

SeedDMS cross-site scripting vulnerabilities

SeedDMS is a free document management system with an easy-to-use web-based user interface. A cross-site scripting vulnerability exists in the AddEvent.php component in SeedDMS version 6.0.7. The vulnerability can be exploited to inject malicious script code via the name and comment parameters...

Delta Electronics DiaLink cross-site scripting vulnerability

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

Design/Logic Flaw

In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment...

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF

The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF

The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...

WordPress wpDiscuz plugin <= 7.3.3 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Comment Addition/Edition/Deletion

Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Comment Addition/Edition/Deletion discovered by Brandon Roldan in WordPress wpDiscuz plugin versions = 7.3.3. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.3.4...

WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by John Castro Pagely in WordPress Comment Engine Pro plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of October 7, 2021 and is not available for download. Reason: Security Issue...

CKEditor WYSIWYG Editor Data Compromise

The vulnerability of the CKEditor WYSIWYG editor is related to the incorrect processing of the “--!” comment. Exploiting this vulnerability may allow an attacker to compromise the integrity of the data...

CVE-2020-21013

emlog v6.0.0 contains a SQL injection via /admin/comment.php...

Sql injection

emlog v6.0.0 contains a SQL injection via /admin/comment.php...

CVE-2020-20799

JeeCMS 1.0.1 contains a stored cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the commentText parameter...

PortlandLabs Concrete CMS Cross-Site Script Vulnerabilities

PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...

CVE-2021-22950

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"...

CVE-2021-22950

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"...

WordPress Ark-commenteditor plugin <= 2.15.6 - Iframe Injection via Comment vulnerability

Iframe Injection via Comment vulnerability discovered by Rasi Afeef in WordPress Ark-commenteditor plugin versions = 2.15.6. Solution Deactivate and delete. This plugin has been closed as of September 23, 2021 and is not available for download. Reason: Security Issue...

Concrete CMS Cross-Site Request Forgery Vulnerability

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site request forgery vulnerability exists in Concrete CMS that allows the deletion of comment attachments in the dialog section...

CVE-2021-22950: Cross-Site Request Forgery (CSRF)

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"...