Design/Logic Flaw

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

CVE-2022-21642 Exposure of whisper participants in discourse

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

MetInfo 跨站脚本漏洞

Metinfo MetInfo is a content management system CMS developed by China's Metinfo using PHP and Mysql. A security vulnerability exists in MetInfo 7.0 beta, which can be exploited by attackers to conduct cross-site scripting XSS attacks...

GHSA-GJRJ-9RJ4-PGWX DoS Vulnerability from Upstream Actix Web Issues

Impact This vulnerability affects all users of the perseus deploy functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from this upstream issue which can allow even a single user to...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from an information disclosure vulnerability that stems from the fact that a maliciously crafted request may result in an intermediate proxy cache...

CVE-2021-41163

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribeurl values. This issue is patched in the latest stable, beta and tests-passed versions of...

CVE-2021-41593

Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure...

CVE-2021-40928

Cross-site scripting XSS vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHPSELF parameter...

PT-2021-22418 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue allows category names to be used for Cross-site scripting XSS attacks. This is mitigated by Discourse's default Content Security Policy, and...

CVE-2021-38138

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...

Design/Logic Flaw

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...

PT-2021-21960 · Onenav · Onenav

Name of the Vulnerable Software and Affected Versions: OneNav beta version 0.9.12 Description: The issue allows for XSS via the Add Link feature. The vendor has stated that there is intentionally no XSS protection at present, as the attack risk is largely limited to a compromised account. However...

CVE-2020-21133

SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid...

Metinfo MetInfo SQL注入漏洞

Metinfo MetInfo is a content management system CMS developed by China Metinfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo, which originates from the product's admin/?n=language&c=languageweb&a=doAddLanguage does not securely validate user input data, and can be exploited ...

PT-2020-16680 · Horizontcms · Horizontcms

Name of the Vulnerable Software and Affected Versions: HorizontCMS versions prior to 1.0.0-beta patched, but version number remains the same Description: The issue allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code. This is achieved by...

D-Link DIR-865L Encryption Problem Vulnerability

The D-Link DIR-865L is a wireless router from AUO D-Link of Taiwan, China. A vulnerability with encryption issues exists in D-Link DIR-865L Ax version 1.20B01 Beta. A remote attacker can exploit the vulnerability to obtain sensitive information...

CVE-2020-13782

D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection...

XSS vulnerability in WeiPHP 5.0 beta frontend Ga***.php at Shenzhen Yuanmeng Cloud Technology Co.

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. An XSS vulnerability exists in the frontend Ga.php of WeiPHP 5.0 beta version by Shenzhen Yuanmeng Yun Technology Co. Attackers can use this vulnerability to insert...

D-Link DIR-859 Information Disclosure Vulnerability

The D-Link DIR-859 is a wireless AC1750 high power Wi-Fi Gigabit router. An information disclosure vulnerability exists in D-Link DIR-859 versions prior to 1.07b03beta, which can be exploited by an attacker to obtain information via the AUTHORIZEDGROUP=1%0a value...

MetInfo SQL Injection Vulnerability (CNVD-2020-14278)

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo 7.0.0 beta, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attacker...