CVE-2019-16665

An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group∾=comment=do=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...

CVE-2019-11548

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint...

CVE-2019-7944

A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Retur...

CVE-2019-5472

An authorization issue was discovered in Gitlab versions 12.1.2, 12.0.4, and 11.11.6 that prevented owners and maintainer to delete epic comments...

CVE-2018-16622

Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...

CVE-2014-10382

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...

CVE-2010-4357

SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...

CVE-2010-4516

Multiple cross-site scripting XSS vulnerabilities in the JXtended Comments component before 1.3.1 for Joomla allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-15593

GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments...

CVE-2013-7233

Cross-site request forgery CSRF vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list...

CVE-2012-6102

lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments aka feedback comments of arbitrary users via a crafted URI...

CVE-2012-5872

ARC aka ARC2 through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause...

Intermesh BV Group Office CRM 安全漏洞

Intermesh BV Group Office CRM is an application from Intermesh BV. Share projects, calendars, files and emails online with colleagues and clients. Easy to use and fully customizable. A security vulnerability exists in Intermesh BV Group Office CRM versions prior to 6.8.119 and 25.0.20, which stem...

PT-2025-22529 · Unknown · Group-Office

Name of the Vulnerable Software and Affected Versions: Group-Office versions prior to 6.8.119 and 25.0.20 Description: The issue is a persistent Cross-Site Scripting XSS vulnerability in Group-Office's tasks comment functionality. This allows attackers to execute arbitrary JavaScript by uploading...

CVE-2005-2689

Multiple cross-site scripting XSS vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject arbitrary web script or HTML via 1 the moderate parameter to the Comments module or 2 htmltext parameter to html/user.php...

CVE-2007-6675

The bsystemcommentsshow function in htdocs/modules/system/blocks/systemblocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules...

CVE-2025-4189

The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This makes it possible for unauthenticated attackers to...

LinkedIn: Previous commentor on post can still comment even after comment permission is changed to disabled

A logic error existed in the comment permission system that allowed users who had previously commented on a post to continue posting additional comments even after the post owner disabled commenting functionality. The vulnerability occurred when an account created a post with comments enabled,...

CVE-2025-4189

The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This makes it possible for unauthenticated attackers to...

CVE-2025-4189

CVE-2025-4189 refers to the Audio Comments Plugin for WordPress, with a CSRF to Stored XSS risk affecting all versions up to 1.0.4. The root cause is missing or incorrect nonce validation on the audio-comments/audior-settings.php page, enabling unauthenticated attackers to induce settings changes...