CVE-2024-8478

The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it...

CVE-2024-42024

creationtimestamp| type| source ---|---|--- 2024-09-05 22:40:17+00:00| seen| Telegram/2paEDeP02FonhasdWZ5DOTlSfP9HXbNaBwWkCheKZVeaUA 2024-09-05 22:40:17+00:00| seen| https://t.me/tengkorakcybercrewz/3973 2024-09-06 00:26:00+00:00| seen| Telegram/H0bymnaDZsjBJZbbufohqYE3SBtAIPDM1Sz-s9D2SdUOEA...

CVE-2024-6585

CVE-2024-6585 affects Lightdash v0.1024.6, with multiple stored XSS vulnerabilities in the markdown dashboard and dashboard comment functionality. The flaws allow remote authenticated threat actors to store and execute malicious JavaScript in the context of a user session. The PT-2024-37737 advis...

CVE-2024-3944

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

HackerOne: Bypass comment restriction

Vulnerability description not provided...

The vulnerability of the Netcat CMS system’s comment module allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the Netcat CMS system’s comment module exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

The vulnerability in the implementation of the deleteComment method in the comments module of the CMS system Netcat allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the deleteComment method in the comments module of the CMS system Netcat is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to the protected information...

CVE-2024-35539

Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently...

PT-2024-26530 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.3.0 Description: A race condition issue was found in the post commenting function, allowing attackers to post multiple comments before spam protection checks are applied, particularly if comments are posted at a high...

WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

Unauthenticated Comment UserID And IP address Disclosure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Contest Gallery versions = 23.1.2...

CVE-2024-41614

symphonycms =2.7.10 is vulnerable to Cross Site Scripting XSS in the Comment component for articles...

CVE-2024-41614

symphonycms =2.7.10 is vulnerable to Cross Site Scripting XSS in the Comment component for articles...

Symphony CMS 安全漏洞

Symphony CMS is a content management system from Symphony CMS open source. A security vulnerability exists in Symphony CMS version 2.7.10 and earlier, which stems from a cross-site scripting XSS vulnerability in the component Comment...

CVE-2024-41614

symphonycms =2.7.10 is vulnerable to Cross Site Scripting XSS in the Comment component for articles...

CVE-2024-41614

Symphony CMS versions

PT-2024-29464 · Unknown · Symphony Cms

Name of the Vulnerable Software and Affected Versions: symphonycms versions 2.7.10 and below Description: The issue is related to Cross Site Scripting XSS in the Comment component for articles. This allows for malicious scripts to be injected into the website, potentially leading to unauthorized...

CVE-2024-6704 Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing...

CVE-2024-6223

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6223 Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Send email only on Reply to My Comment Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Send email only on Reply to My Comment Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6224 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 251d7c486476 Credi...