CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. 간단한 XSS : 2. 간단한 CSRF: 공격자 웹사이트 코드--- https://github.com/kuangting4231/wordpress.github.io 3. CSRF 원격 코드 실행: 공격자 웹사이트 코드--- https://github.com/kuangting4231/assigment1.github.io 완화 1. 관리자의 살균 과정에서 로직 결함 수정. 다음 두 줄을 /wp-admin/includes/ajax-actions.php 및...

CVE-2026-3494_Verfication

CVE-2026-3494 - MariaDB serveraudit ログ記録検証 PoC このプロジェクトは、SQLクエリ内で特定のインラインコメント（、--）が使用された際に、MariaDBのserverauditプラグインにおける潜在的な監査ログバイパスを検証・分析するための専用環境を提供します。 主な発見 v11.8.6におけるログ記録漏れ : MariaDB v11.8.6（以前はパッチ適用済みと見なされていたバージョン）において、特定のクエリ（例: コメント付きのSET PASSWORDやError 1046のケース）が監査ログに記録されないことを確認しました。...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - 認証済み（Author+）ディレクトリトラバーサルによる任意ファイル読み取り 説明 WordPress 用プラグイン「WordPress Comments Import & Export」は、コメントインポート処理中のファイルパス検証が不十分なため、バージョン 2.3.7 以前で任意ファイル読み取りに対して脆弱です。これにより、認証された攻撃者（Author レベル以上のアクセス権を持つユーザー）が任意の 情報 Type: plugin CVSS Score: 6.5...

CVE-2026-103289

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103274

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103289

The Ghost content management system, specifically versions 5.9.0 before 6.44.1 , is vulnerable to an authorization bypass within its comments feature . An input validation issue allows authenticated members to access and view restricted comment data for which they lack proper authorization. No sp...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

EUVD-2026-90682

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

EUVD-2026-90667

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE このリポジトリは、脆弱性 CVE-2025-62222 の概念実証（PoC）を含んでいます。VS Code の GitHub Copilot Chat のコンテキストを操作し、コメント内に隠されたプロンプトインジェクションによって、開発者のマシンでリモートコード実行（RCE）を達成する方法を示しています。 ⚠️ 免責事項 ⚠️ 教育目的専用。...

CVE-2026-103289: Improper Neutralization of Special Elements in Data Query Logic

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103274: Missing Authorization

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-100278

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

EUVD-2026-90022

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

CVE-2026-100278

In JetBrains YouTrack versions prior to 2026.2.19197 , a vulnerability allows users with restricted permissions to edit and hide comments belonging to other users. This flaw impacts the integrity of user comments within the platform. No specific exploit information or remediation details are prov...

CVE-2026-100278

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

GHSA-PRGH-XP8R-P3M5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...