BIT-DISCOURSE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...

CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...

CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...

CVE-2025-70458

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

CVE-2025-70458

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

EUVD-2025-206330

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

CVE-2025-70458

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Sourcecodester Domain Availability Checker v1.0 . The flaw is located in the DomainCheckerApp class within the domain/script.js file, specifically inside the createResultElement method. The vulnerability is caused by the improper hand...

CVE-2025-70458

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

EUVD-2023-51905

Malicious code in bioql PyPI...

CVE-2024-12520: Improper Neutralization of Input During Web Page Generation

The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominionshortcodesdomainsearch6' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied...

PT-2025-1881 · WordPress · The Dominion – Domain Checker

Name of the Vulnerable Software and Affected Versions: The Dominion – Domain Checker for WPBakery plugin for WordPress versions up to, and including, 2.2.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied...

CVE-2023-47810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asdqwe Dev Ajax Domain Checker plugin = 1.3.0 versions...

CVE-2023-47810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asdqwe Dev Ajax Domain Checker plugin = 1.3.0 versions...

CVE-2023-47810

CVE-2023-47810 affects the WordPress Ajax Domain Checker plugin up to version 1.3.0. Root cause: improper neutralization of input during web page generation, leading to Stored Cross‑Site Scripting (XSS) as described in multiple sources. Exploitation context from connected docs indicates the vulne...

CVE-2023-47810: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asdqwe Dev Ajax Domain Checker plugin = 1.3.0 versions...

WordPress Plugin Ajax Domain Checker Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2023-30620

Name of the Vulnerable Software and Affected Versions Asdqwe Dev Ajax Domain Checker plugin versions prior to 1.3.0 Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For Asdqwe Dev Ajax Domain...

WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Domain Checker Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47810 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 221e73a9646b Credits Ngô Thiên An ancorn from VNPT-VCI...