Symphony CMS 安全漏洞

Symphony CMS is a content management system from Symphony CMS open source. A security vulnerability exists in Symphony CMS version 2.7.10, which stems from the presence of a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via editorial...

PT-2024-40839 · Unknown · Javaparser

Name of the Vulnerable Software and Affected Versions: JavaParser affected versions not specified Description: The issue is related to a security exception in the CommentsInserter class. The crash occurs in the insertComments function, which is part of the JavaParser library. The error is also...

CVE-2024-7648

The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access...

The vulnerability of the multi-site content management system UMI CMS, related to the lack of measures taken to protect the SQL query structure, allows for the execution of arbitrary SQL queries.

The vulnerability of the multi-site content management system UMI CMS is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries through the comment creation function of the forum...

WordPress plugin Opal Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-6704

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing...

CVE-2024-6704

The CVE-2024-6704 entry applies to the WordPress plugin Comments – wpDiscuz. Affected versions are

CVE-2024-6704 Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing...

PT-2024-37811 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: The Comments – wpDiscuz plugin for WordPress versions prior to 7.6.22 Description: The issue is related to HTML Injection due to a lack of filtering of HTML tags in comments. This allows unauthenticated attackers to add HTML, such as...

Exploit for Code Injection in Get-Simple Getsimple_Cms

CVE-2022-41544 Exploit Script This repository contains a scri...

WordPress One Click Close Comments plugin <= 2.7.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin One Click Close Comments versions = 2.7.1...

WordPress One Click Close Comments Plugin <= 2.7.1 is vulnerable to Sensitive Data Exposure

Software One Click Close Comments Type Plugin Vulnerable versions = 2.7.1 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6546 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 20aa54d1deb1 Credits stealthcopter...

CVE-2024-6546

CVE-2024-6546 affects One Click Close Comments for WordPress (

CVE-2024-6546 One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure

The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

PT-2024-37703 · WordPress · One Click Close Comments

Name of the Vulnerable Software and Affected Versions: One Click Close Comments plugin for WordPress versions up to and including 2.7.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin uses bootstrap and leaves test files with display errors on. This allo...

Heap-based Buffer Overflow

fiona is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper handling of long filenames, comments, or extra fields in within zlib components that contain integer overflow vulnerabilities, which can result in an application crash or potential code execution...

Cross-Site Request Forgery (CSRF)

ProcessWire is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to inadequate handling of comments functionality, which allows a remote attacker to comment as another user...

Cross Site Scripting(XSS)

Calibre-Web is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization performed by the cleanstring function, which allows an attacker perform XSS by inserting a payload into the comments field...

ProcessWire Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...

GHSA-R9VW-CJF9-XH4X ProcessWire Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality...