3687 matches found
Afian FileRun security vulnerability
Afian FileRun is a full-featured web-based file manager. A security vulnerability exists in Afian FileRun that stems from the presence of a corrupted access control issue that allows an attacker to delete comments on files uploaded by other users...
WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software WooDiscuz – WooCommerce Comments Type Plugin Vulnerable versions = 2.3.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49759 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f67f1f9aa58c Credits...
CVE-2023-47437
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting XSS attack. The vulnerability exists due to inadequate input validation in the Project Description and comments, which enables an attacker to inject malicious java script...
Pachno Cross-Site Scripting Vulnerability
Pachno is an open source platform for collaboration from Pachno Open Source. A cross-site scripting vulnerability exists in Pachno version 1.0.6, which stems from insufficient validation of inputs in project descriptions and comments, allowing an attacker to inject malicious java script...
Cross Site Scripting (XSS)
DOMSanitizer is vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to improper sanitization of HTML comments in DOMSanitizer.php. This could allow an attacker to inject malicious code via a HTML comment...
Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Comments Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
Design/Logic Flaw
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-47775
Cross-Site Request Forgery CSRF vulnerability in gVectors Team Comments — wpDiscuz plugin = 7.6.11 versions...
CVE-2023-47775
Cross-Site Request Forgery CSRF vulnerability in gVectors Team Comments — wpDiscuz plugin = 7.6.11 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in gVectors Team Comments — wpDiscuz plugin = 7.6.11 versions...
CVE-2023-47775
CVE-2023-47775 : Cross-Site Request Forgery in the WordPress plugin wpDiscuz (gVectors Team Comments) affects versions
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
Cross site request forgery (csrf)
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands ...
CVE-2023-48293 XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allow...
golang: html/template: improper handling of HTML-like comments within script contexts
A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...
golang: html/template: improper handling of HTML-like comments within script contexts
A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...