PT-2017-6636

Name of the Vulnerable Software and Affected Versions Beaker version 20.1 Description A cross-site scripting XSS issue exists in the edit comment dialog, allowing remote authenticated users to inject arbitrary web script or HTML by writing a crafted comment on an acked or nacked canceled job. Thi...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...

Database Password Disclosure Vulnerability in Bycms comment-add and Comment.php Methods

Bycms Beyuncms is a content management system based on thinkphp 5.0.9. A database password disclosure vulnerability exists in the Bycms comment-add and Comment.php methods. An attacker can exploit this vulnerability to obtain the database connection account and password...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

REST API can bypass comment approval.

More info at https://www.drupal.org/SA-CORE-2017-004...

REST API can bypass comment approval.

More info at https://www.drupal.org/SA-CORE-2017-004...

Cross-Site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not filter the user supplied input to wptexturize via a comment or a post...

CVE-2017-11594

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11594

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11594: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment...

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11413

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...

CVE-2017-11416

Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23893)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/appcomment/controller/insert.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of the 'name'...

PT-2017-11995

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the $ GET'id' variable in the /dapur/apps/app article/controller/comment status.php endpoint. Recommendations For Fiyo CMS version 2.0.7, consider...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23896)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/apparticle/controller/commentstatus.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to execute arbitrary SQL commands with the help of...

Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23897)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/appcomment/controller/commentstatus.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to execute arbitrary SQL commands with the help of...