4112 matches found
CVE-2019-17583
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service resource consumption via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer...
CVE-2007-6691
Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to 1 "hotlink protection" in the URL rewrite module, 2 a WebDAV view in the WebDAV module, 3 a comment view in the Comment module, 4 unspecified "item information disclosure attacks" in the Core modu...
InoERP 0.7.2 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting Google Dork: None Exploit Author: strider Vendor: http://inoideas.org/ Software Link: https://github.com/inoerp/inoERP Version: 0.7.2 Tested on: Debian 10 Buster x64 / Kali Linux CV...
InoERP 0.7.2 - Persistent Cross-Site Scripting
InoERP 0.7.2 - Persistent Cross-Site Scripting Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting Google Dork: None Date: 2019-09-14 Exploit Author: strider Vendor: http://inoideas.org/ Software Link: https://github.com/inoerp/inoERP Version: 0.7.2 Tested on: Debian 10 Buster x64 / Kal...
InoERP 0.7.2 - Persistent Cross-Site Scripting
Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting Google Dork: None Date: 2019-09-14 Exploit Author: strider Vendor: http://inoideas.org/ Software Link: https://github.com/inoerp/inoERP Version: 0.7.2 Tested on: Debian 10 Buster x64 / Kali Linux CVE : None...
InoERP 0.7.2 Cross Site Scripting
Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting Google Dork: None Date: 2019-09-14 Exploit Author: strider Vendor: http://inoideas.org/ Software Link: https://github.com/inoerp/inoERP Version: 0.7.2 Tested on: Debian 10 Buster x64 / Kali Linux CVE : None...
gitea -- information disclosure
The Gitea Team reports: When a comment in an issue or PR mentions a user using @username, the mentioned user receives a mail notification even if they don't have permission to see the originating repository...
Arbitrary File Upload Vulnerability in Guojiz
Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload any type of image, such as a php Trojan horse, when editing a forum post or adding a comment via the upload image...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-6995
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...
WordPress Sell Downloads 1.0.86 Cross Site Scripting
Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: September 09,2019 Vendor Homepage: https://wordpress.dwbooster.com/content-tools/sell-downloads Software Link :...
WordPress Sell Downloads 1.0.86 Plugin - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: email protected Discovery Date: September 09,2019 Vendor Homepage:...
FreeType Buffer Overflow Vulnerability (CNVD-2019-30720)
FreeType is an open source font rendering library written in the C language. A buffer overflow vulnerability exists in the skipcomment file in psaux/psobjs.c in versions of FreeType prior to 2.6.1. The vulnerability stems from a networked system or product performing operations in memory without...
Scientific Linux Security Update : fence-agents on SL7.x x86_64 (20190806)
fence-agents: mis-handling of non-ASCII characters in guest comment fields CVE-2019-10153 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128217; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...
WordPress feature-comments plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. feature-comments is a comment management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
Django CRM 0.2.1 Cross Site Request Forgery Vulnerability
Exploit for php platform in category web applications Information -------------------- Advisory by Netsparker Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1 Affected Software: Django CRM Affected Versions: 0.2.1 Homepage: https://github.com/MicroPyramid/Django-CRM Vulnerability: Cross-si...
WordPress embed-comment-images plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. embed-comment-images is a plugin that supports embedding image links in comments. A cross-site scripting vulnerability exists in the...
CVE-2014-10382
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
CVE-2014-10382
The CVE-2014-10382 vulnerability affects the WordPress feature-comments plugin prior to version 1.2.5. It is a cross‑site request forgery (CSRF) flaw that allows an attacker to perform actions like featuring or burying comments by authenticated/unauthenticated users depending on the context descr...