CVE-2021-24393

A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24393

The CVE-2021-24393 entry concerns the WordPress plugin Comment Highlighter (versions up to 0.13). The vulnerability is a SQL injection caused by unsanitized/unchecked c GET parameters that are inserted into an SQL statement. The provided connected documents corroborate this exact flaw across mult...

PT-2021-15926

Name of the Vulnerable Software and Affected Versions Comment Highlighter WordPress plugin versions 0.13 and earlier Description The issue arises from a c GET parameter in the Comment Highlighter WordPress plugin that is not properly sanitized, escaped, or validated before being inserted into a S...

WordPress plugin SQL injection vulnerability

WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in WordPress plugin Comment Highlighter 0.13 and earlier versions, which stems from a SQL injection caused by c GET parameters not being properly cleaned up, escaped, or validated prior to...

CVE-2021-24393: Improper Neutralization of Special Elements used in an SQL Command

A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

WordPress Comment Link Remove and Other Comment Tools plugin <= 2.1.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to bulk comment deletion

Cross-Site Request Forgery CSRF vulnerability leading to bulk comment deletion discovered by Martin Vierula Trustwave in WordPress Comment Link Remove and Other Comment Tools plugin versions = 2.1.4. Solution Update the WordPress Comment Link Remove and Other Comment Tools plugin to the latest...

CVE-2021-20775

Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...

Input validation

Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...

CVE-2021-20775

Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...

CVE-2021-20775

Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...

CVE-2021-20775: Improper Input Validation

Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege...

PT-2021-14230

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 4.10.0 through 5.5.0 Description: The issue is related to improper input validation, allowing a remote authenticated attacker to obtain data of Comment and Space without the necessary viewing privilege. This can lead to...

Cybozu Garoon Information Disclosure Vulnerability (CNVD-2021-59718)

Cybozu Garoon, a portal-based OA system of Cybozu Japan, is vulnerable to information disclosure. An attacker can use this vulnerability to obtain data from Comment and Space without viewing privileges...

Cybozu Garoon input validation vulnerability

Cybozu Garoon, a portal-based OA system of Cybozu Japan, is vulnerable to information disclosure. An attacker can use this vulnerability to obtain data from Comment and Space without viewing privileges...

Edit Comments <= 0.3 - Unauthenticated SQL Injection

The plugin does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue Post a comment on a page, then open https://example.com//?jaleditcomments=7%20AND%20SELECT%209114%20FROM SELECTSLEEP5wjzD...

Comment Highlighter <= 0.13 - Authenticated SQL Injection

A c GET parameter of the plugin is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. GET...

php:php-fuzz-exif: Heap-buffer-overflow in _estrdup

Detailed Report: https://oss-fuzz.com/testcase?key=6470622615044096 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 13 Crash Address: 0x60400007fb3e Crash State: estrdup exifprocessusercomment...

Halo cross-site scripting vulnerabilities

Halo is a light, clean and powerful Java blogging system. Halo version 0.4.3 suffers from a cross-site scripting vulnerability that can be exploited by attackers via CommentAuthorUrl...

Magecart Hackers Hide Stolen Credit Card Data Into Images for Evasive Exfiltration

Cybercrime actors part of the Magecart group have latched on to a new technique of obfuscating the malware code within comment blocksBlockcomment and encoding stolen credit card data into images and other files hosted on the server, once again demonstrating how the attackers are continuously...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description I found a stored XSS in your project which is lead by adding client's comment. 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Create a Client. 2. Enter " in the comments. 3. Save and you will see XSS. 💥 Impact This vulnerability is capable of stored XSS...