AeroCMS SQL Injection Vulnerability

AeroCMS is a content management system from AeroCMS, Inc. A security vulnerability exists in AeroCMS v0.0.1, which stems from the id parameter of its adminpostcomments.php component allowing an attacker to implement SQL injection resulting in access to database information. No detailed...

PT-2022-27570 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to access database information through a SQL Injection vulnerability. This vulnerability is exploited via the id parameter at the "admin/post comments.php" endpoint. Recommendation...

CVE-2022-43492

Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...

CVE-2022-43492

Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...

Spoofing

Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...

CVE-2022-43492

CVE-2022-43492 affects WordPress with the wpDiscuz plugin at version 7.4.2. It is an Insecure Direct Object References (IDOR) in the Comments feature. The NVD entry lists CVSS v3.1 base metrics: 8.8 (High) with NEURAL: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; PatchStack cites a lower impact vector. R...

CVE-2022-43492: Authorization Bypass Through User-Controlled Key

Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...

PT-2022-26943

Name of the Vulnerable Software and Affected Versions wpDiscuz plugin version 7.4.2 Description The issue is related to an Insecure Direct Object References IDOR vulnerability in the Comments section of the wpDiscuz plugin on WordPress, which requires authentication with subscriber or higher...

CVE-2022-42000

Cross-site Scripting XSS vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage...

PT-2022-26205 · Unknown +1 · Bluespicesocialprofile +1

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a user with comment permissions to inject arbitrary HTML into the comment section of a wikipage, which can lead to Cross-site Scripting XSS. This occurs in the...

Upgraded Q -> M from #323 [1668467355303]

Judge has assessed an item in Issue 323 as M risk. The relevant finding follows: L00: beforeTokenTransfer function called with wrong params in LBToken Line 237 seems to be a copy pasta mistake from line 209 in LBToken.sol. On line 237 when burning tokens, to should be zero, and amount of from's...

WordPress Add Comments plugin <= 1.0.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by roguethread in WordPress Add Comments plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of November 9, 2022 and is not available for download. This closure is temporary, pending a full review...

Saibamen HotelManager Cross-site Scripting Vulnerability

Saibamen HotelManager is a web application for managing hotels written in Laravel by the individual developer Saibamen. A security vulnerability exists in Saibamen HotelManager v1.2, which stems from improper sanitization of its comment and contact fields, allowing an attacker to implement...

CVE-2022-41435: Improper Neutralization of Input During Web Page Generation

OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...

CVE-2022-41435

OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...

CVE-2022-39017

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments...

CVE-2022-39017: Improper Input Validation

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 15.0 through 15.2.5,...

Cross-Site Scripting (XSS)

feehi/feehicms is vulnerable to cross-site scripting. The vulnerability exists when sending picture comments in single page module which allows an attacker to inject and execute arbitrary javascript via a crafted payload...

PT-2022-5792 · Dropbear +3 · Dropbear +3

Name of the Vulnerable Software and Affected Versions: OpenWrt LuCI version git-22.140.66206-02913be Description: The issue is related to a stored cross-site scripting XSS vulnerability in the /system/sshkeys.js component. This vulnerability allows attackers to execute arbitrary web scripts or HT...