CVE-2017-14957

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can for example change global settings or create/delete posts. It is also possible to execute JavaScript against...

Eaton ELCSoft Out-of-Bounds Write Remote Code Execution Vulnerability

The Eaton ELCSoft programmable logic control software runs on a PC and can help configure the ELC controller. An out-of-bounds write remote code execution vulnerability exists in Eaton ELCSoft Device Comment Range Parsing, which results in a lack of proper validation of user-supplied data, leadin...

Cross site scripting

Cross-site scripting XSS vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitrary web script or HTML via writing a crafted comment on an acked or nacked canceled job...

Cross-Site Scripting (XSS)

genix/cms is susceptible to cross-site scripting XSS attacks. When a registered user replies to a post with an XSS payload and the administrator views this comment, the payload is executed...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...

Database Password Disclosure Vulnerability in Bycms comment-add and Comment.php Methods

Bycms Beyuncms is a content management system based on thinkphp 5.0.9. A database password disclosure vulnerability exists in the Bycms comment-add and Comment.php methods. An attacker can exploit this vulnerability to obtain the database connection account and password...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

REST API can bypass comment approval.

More info at https://www.drupal.org/SA-CORE-2017-004...

REST API can bypass comment approval.

More info at https://www.drupal.org/SA-CORE-2017-004...

Cross-Site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not filter the user supplied input to wptexturize via a comment or a post...

CVE-2017-11594

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11594

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11416

Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...

CVE-2017-11413

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23896)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/apparticle/controller/commentstatus.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to execute arbitrary SQL commands with the help of...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23893)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/appcomment/controller/insert.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of the 'name'...