42 matches found
WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)
WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wpksespost accepts a with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a inside the cite value, and wptexturize leaves the attribute open so onfocus/autofoc...
PT-2026-95257
Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 7.1 Description An unauthenticated stored cross-site scripting XSS issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the wpautop function, which converts line breaks into paragraphs. A...
Malicious code in extension-blockquote (npm)
--- Credit: OpenSSF source...
AZL-81020 CVE-2026-4833 affecting package discount 2.2.7-10
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...
AZL-81062 CVE-2026-4833 affecting package rubygem-rdiscount 2.2.7.4-1
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...
UBUNTU-CVE-2026-4833
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...
CVE-2026-4833
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...
CVE-2026-4833 Orc discount Markdown markdown.c compile recursion
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...
EUVD-2022-0618
Malicious code in bioql PyPI...
CVE-2024-25873
Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...
Action Text interpreter Ruby plain_text_for_blockquote_node DoS
The vulnerability of the plaintextforblockquotenode function in the Action Text interpreter for Ruby is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...
SUSE CVE-2024-47888
Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. Carefully crafted text can cause the...
DEBIAN-CVE-2024-47888
Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. Carefully crafted text can cause the...
UBUNTU-CVE-2024-47888
Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. Carefully crafted text can cause the...
CVE-2024-47888 Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node
Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. Carefully crafted text can cause the...
MAL-2024-9613 Malicious code in extension-blockquote (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in extension-blockquote (npm)
--- -= Per source details. Do not edit below this line.=-...
Regular Expression Denial of Service (ReDoS)
Overview actiontext is a package to edit and display rich text in Rails applications. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the plaintextforblockquotenode helper function due to the usage of an insecure regular expression. By...
Ruby on Rails: Action Text ReDoS (Ruby 3.1 or lower)
A vulnerability was discovered in the ActionText component of the Rails web framework for Ruby versions 3.1 and lower. The vulnerability was caused by a Regular Expression Denial of Service ReDoS issue in the plaintextforblockquotenode method. This method was used in the...
CVE-2024-25873
Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...