PT-2025-18180 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: A stored cross-site scripting XSS issue was found in the comments feature of YesWiki, a wiki system written in PHP. This issue allows a malicious actor to inject JavaScript payloads that are stored...

YesWiki 安全漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A security vulnerability exists in versions of YesWiki prior to 4.5.4, which stems from insufficient input cleanup for the comments feature and could lea...

CVE-2025-46346: Improper Neutralization of Input During Web Page Generation

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting XSS vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user...

USN-7464-1 jupyter-notebook vulnerability

It was discovered that Jupyter Notebook did not properly parse HTML comments under certain circumstances. An attacker could possibly use this issue to cause a regular expression denial of service ReDoS...

USN-7464-1: Jupyter Notebook vulnerability

It was discovered that Jupyter Notebook did not properly parse HTML comments under certain circumstances. An attacker could possibly use this issue to cause a regular expression denial of service ReDoS...

CVE-2025-30357

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

CVE-2025-30357

CVE-2025-30357 affects NamelessMC forum software. In versions ≤ 2.1.4, a malicious user posting spam across topics could trigger deletion of that user by an admin, which would cause all that user’s posts (and in turn related topics by unrelated users) to be marked as deleted. The issue has been p...

CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

PT-2025-17310 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue arises when a malicious user leaves spam comments on many topics. If an administrator deletes the malicious user's account, all their posts along with the associated topics by unrelat...

Malicious code in dc-comments-beta-dropin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b940d69d756e252cedb90472d991e301153623e4118e99320cf87b299b68d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dc-comments-beta-dropin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3234 Malicious code in dc-comments-beta-dropin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b940d69d756e252cedb90472d991e301153623e4118e99320cf87b299b68d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-15922

Name of the Vulnerable Software and Affected Versions: azurecurve Shortcodes in Comments plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode...

CVE-2025-2809: Improper Control of Generation of Code

The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it...

PT-2025-15278 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under a comment for an Article. Recommendations: For Typecho...

CVE-2025-0613

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed...

CVE-2025-0613

The Photo Gallery by 10Web WordPress plugin (versions prior to 1.8.34 ) is vulnerable to an Unauthenticated Stored-XSS attack. The root cause is the failure to properly sanitize and escape comments submitted by unauthenticated users on images. When these comments are subsequently displayed, they ...

CVE-2025-0613 Photo Gallery < 1.8.34 - Unauthenticated Stored XSS

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed...