74 matches found
CVE-2023-33216
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9...
Angular 跨站脚本漏洞
Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. A security vulnerability exists in Angular version 11.0.4, 11.1.0-next.2, which stems from the fact that HTML does not specify any method to escape text in...
GitLab Enterprise Edition 跨站脚本漏洞
GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition versions 14.4.0 through 14.9.1 that stems from insufficient cleanup of user-supplied data in comments. A remote user can exploit this vulnerability to inject and...
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2021-011
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal, along with a hotfix for that update. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can...
Cross-site Scripting (XSS)
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS by allowing unprivileged application users to store malicious scripts in the comments sectio...
UK CMS 跨站脚本漏洞
Lingji Network Technology UKcms is a PHP-based content management system CMS from China's Lingji Network Technology. UK CMS suffers from a security vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload in the Comments section...
CVE-2021-24236
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename...
Hibernate ORM vulnerable to SQL injection
Overview Hibernate ORM is an ORM framework for Java. Hibernate ORM can be configured hibernate.usesqlcomments to true, which is false by default to add comments to generated SQL statements, aimed at debugging purpose. When hibernate.usesqlcomments is configured to true, malicious input may produc...
New WordPress Flaw Lets Unauthenticated Remote Attackers Hack Sites
If for some reason your WordPress-based website has not yet been automatically updated to the latest version 5.1.1, it's highly recommended to immediately upgrade it before hackers could take advantage of a newly disclosed vulnerability to hack your website. Simon Scannell, a researcher at RIPS...
Catfish CMS Cross-Site Scripting Vulnerability
Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in comments in Catfish CMS version 4.7.21. A remote attacker can exploit this vulnerability by sending the 'pinglun' parameter to cat/index/index/pinglun to inject arbitrary web...
CVE-2017-12813
PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section...
PivotX cross-site scripting vulnerability (CNVD-2016-03594)
Pivotx is an open source blog content management system Blog CMS. The system supports built-in comment review, spam protection and template replacement. A reflective cross-site scripting vulnerability exists in PivotX 2.3.11. An attacker can inject JavaScript code or bypass CSRF protection...
DEBIAN-CVE-2015-7686
Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...
Serendipity cross-site scripting vulnerability (CNVD-2015-06044)
Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in the js/2k11.min.js file in Serendipity 2.0.1 and prior versions of the 2k11 theme, which stems...
Cross site scripting
Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...
Anchor CMS 0.9.1 - Persistent Cross-Site Scripting
Exploit Title : AnchorCMS Stored XSS exploit v0.9.1 Exploit Author: DURAKIBOX / dn5 Website : halisduraki.com Email : [email protected] Date : 18.7.2013. CMS uri : http://anchorcms.com/ Version : AnchorCMS File : article.php file shows article/post page with text written by owners. If owner enable...
Movable Type vulnerable to cross-site request forgery
Overview Movable Type contains a cross-site request forgery vulnerability. Movable Type contains a cross-site request forgery vulnerability in entering comments and community functionality. Impact If a user views a malicious page while logged in, settings may be changed, data may be viewed or...
CVE-2009-2933
SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the itemsnumber parameter...