Design/Logic Flaw

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

CVE-2021-3137

CVE-2021-3137 affects XWiki 12.10.2, enabling XSS via an SVG document uploaded to the comment feature. Root cause: insecure handling of SVG uploads leading to script injection. Impact: cross-site scripting in affected deployments. Mitigation: vendor fix (VendorFix) referenced by OpenVAS entries; ...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

PT-2021-19268

Name of the Vulnerable Software and Affected Versions XWiki version 12.10.2 Description The issue allows for XSS via an SVG document to the upload feature of the comment section. Recommendations For XWiki version 12.10.2, update to a version that fixes this issue to prevent XSS attacks through th...

CVE-2021-3137: Improper Neutralization of Input During Web Page Generation

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)

Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...

Xwiki CMS 12.10.2 Cross Site Scripting

Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...

Server-Side Template Injection (SSTI)

pwntools is vulnerable to server-side template injection. An attacker is able to inject and execute arbitrary code via the Shellcraft generation due to insecure parsing of strings that containing end of multiline comment...

Mail.ru: Stored XSS on store.my.games

Stored XSS in comment viewing functionality on store.my.games...

CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16954

CVE-2019-16954 affects SolarWinds Web Help Desk 12.7.0 with an HTML injection vulnerability via the Comment in a Help Request ticket. The provided connected documents indicate the flaw is caused by accepting user input in a Comment and injecting it into HTML, but do not provide explicit exploit s...

CVE-2019-16954: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

SolarWinds Web Help Desk injection vulnerability

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

CVE-2021-3026

CVE-2021-3026 affects Invision Community IPS Community Suite prior to 4.5.4.2 and enables cross-site scripting during the quoting of a post or comment. The issue is described as XSS in the quoting workflow, with multiple external records corroborating the vulnerability. The provided documents do ...

CVE-2021-3026: Improper Neutralization of Input During Web Page Generation

Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...

CVE-2016-20002

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20002

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

Design/Logic Flaw

The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

Drupal Security Vulnerabilities

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal REST/JSON project 7.x-1.x that allows comment access bypass...