4670 matches found
WordPress Comments Not Replied To plugin < 1.5.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Comments Not Replied To plugin versions 1.5.2. Solution Update the WordPress Comments Not Replied To plugin to the latest available version at least 1.5.2...
WordPress Internal Comments plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Internal Comments plugin versions = 1.2.2. Solution Update the WordPress Internal Comments plugin to the latest available version at least 1.2.3...
WordPress Delete All Comments of wordpress plugin <= 4.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Delete All Comments of wordpress plugin versions = 4.2. Solution Update the WordPress Delete All Comments of wordpress plugin to the latest available version at least 4.3...
PeerTube licensing issue vulnerability
PeerTube is a decentralized video sharing service platform. It is used to create video projects. versions of PeerTube prior to 4.1.0 contain an authorization issue vulnerability that can be exploited by attackers to create new comments or reply to comments in private videos...
IERC4626RouterBase - withdraw - slippage does not work
Lines of code Vulnerability details Impact The router does not have the intended behavior: according to the EIP , withdraw burn shares to withdraw exactly assets, so the slippage protection should protect the user from burning too many shares. Furthermore, comments in the interface are incorrect ...
CVE-2022-0279
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users...
WordPress cross-site scripting vulnerabilities
WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Shield Security plugin version 13.0.6 previously had a cross-site scripting vulnerability, whic...
Improper Access Control in liangliangyy/djangoblog
Description "formvalid" function in comments/views.py file performs the task of saving user comments. However, this function doesn't check the status of article, so users can leave comments on draft article or public article with commentstatus is off. Proof of Concept - Step 1: Login as admin in...
in microweber/microweber
Description Sensitive information as part of the error is getting disclosed while viewing comments from "loadmodule:commentssearch=" Proof of Concept 1. Login to https://demo.microweber.org 2. Visit https://demo.microweber.org/demo/admin/view:modules/loadmodule:commentssearch= 3. Now enter anythi...
CVE-2021-4035
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
CVE-2021-4035
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
Cross site scripting
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
PT-2022-11220 · Tinymce · Tinymce
Name of the Vulnerable Software and Affected Versions: tinymce editor affected versions not specified Description: A stored cross-site scripting issue has been identified in the comments section of report creation, caused by an obsolete version of the tinymce editor. To exploit this issue,...
CVE-2021-4035: Improper Neutralization of Input During Web Page Generation
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
Improper Access Control in publify/publify
Description Article in draft mode can only be accessed by admins who have permission to manage article. Anonymous users can't view but can leave comments on article in draft mode. The cause of the vulnerability is that the draft article is setting to comment enabled and createcomment function onl...
CVE-2021-4035
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...
CVE-2022-23889
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments...
CVE-2022-23889
The CVE-2022-23889 entry concerns YzmCMS v6.3 where the comment function can be operated concurrently, enabling an attacker to generate an unusually large number of comments. The core issue is a race/concurrency condition in the comment handling code, leading to potential resource exhaustion or i...
CVE-2022-22791
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...