3687 matches found
PT-2025-17310 · Unknown · Namelessmc
Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue arises when a malicious user leaves spam comments on many topics. If an administrator deletes the malicious user's account, all their posts along with the associated topics by unrelat...
MAL-2025-3234 Malicious code in dc-comments-beta-dropin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b940d69d756e252cedb90472d991e301153623e4118e99320cf87b299b68d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in dc-comments-beta-dropin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b940d69d756e252cedb90472d991e301153623e4118e99320cf87b299b68d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2025-15278 · Typecho · Typecho
Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under a comment for an Article. Recommendations: For Typecho...
CVE-2025-0613
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed...
CVE-2025-0613
The CVE-2025-0613 entry affects the WordPress plugin Photo Gallery by 10Web (prior to version 1.8.34). The vulnerability arises from insufficient sanitization and escaping of comments added to images by unauthenticated users, leading to an Unauthenticated Stored XSS when those comments are displa...
CVE-2025-0613 Photo Gallery < 1.8.34 - Unauthenticated Stored XSS
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed...
[SECURITY] Fedora 41 Update: augeas-1.14.2-0.4.20250324git4dffa3d.fc41
A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...
CVE-2025-2163
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2163
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2163
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2163
CVE-2025-2163 refers to a CSRF to Stored XSS vulnerability in the Zoorum Comments WordPress plugin (versions up to and including 0.9). The issue arises from missing or incorrect nonce validation in zoorum_set_options(), enabling unauthenticated attackers to update plugin settings and inject scrip...
CVE-2025-2163 Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2163 Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
WordPress plugin Zoorum Comments 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Zoorum Comments plugin <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Zoorum Comments versions = 0.9...
DEBIAN-CVE-2025-2123
A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function getvar of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument...
GeSHi 代码注入漏洞
GeSHi is a Generic Syntax Highlighter open source PHP generic syntax highlighter. A code injection vulnerability exists in GeSHi version 1.0.9.1 and earlier, which stems from incorrect manipulation of the parameters default-styles, keywords-1, keywords-2, keywords-3, keywords-4, and comments can...
CVE-2025-25130
Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments By Status: from n/a through = 2.1.1...