New WordPress Flaw Lets Unauthenticated Remote Attackers Hack Sites

If for some reason your WordPress-based website has not yet been automatically updated to the latest version 5.1.1, it's highly recommended to immediately upgrade it before hackers could take advantage of a newly disclosed vulnerability to hack your website. Simon Scannell, a researcher at RIPS...

Cross-Site Scripting (XSS)

github.com/Dolibarr/dolibarr is vulnerable to cross-site scripting XSS. A remote attacker is able to store and inject arbitrary Javascript into a victimm's browser via the comments and public or private notes, which executes in the context of the user's browser when the comments or notes are load...

UBUNTU-CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

CVE-2018-16808: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

PT-2019-9375

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1 Description The issue concerns Stored XSS in the expense reports plugin. It occurs via the comments parameter, or a public or private note, in the expensereport/card.php file. Recommendations For versions prior...

Insecure Authorization

libmosquitto.so is vulnerable to insecure authorization. An empty ACL file or containing only blank lines or comments is treated as not defined and no topic access would be denied. This could lead to access being incorrectly granted and allow an attacker to access or modify resources that are...

Sql injection

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587

CVE-2019-7587 affects Bo-blog Wind through 1.6.0-r. The vulnerability is a SQL Injection in the admin.php/comments/batchdel/ comID parameter, caused by mishandling in the mode/admin.mode.php delBlockedBatch function. The connected sources corroborate the issue and describe it as a SQL injection v...

CVE-2019-7587

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587: Improper Neutralization of Special Elements used in an SQL Command

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

PT-2019-18659

Name of the Vulnerable Software and Affected Versions Bo-blog Wind versions through 1.6.0-r Description The issue allows SQL Injection via the comID parameter in the "admin.php/comments/batchdel/" endpoint because this parameter is mishandled in the delBlockedBatch function in mode/admin.mode.php...

Automattic: No Rate Limit on CrowdSignal Polls when Adding Comment

Hi team! I hope this isn't duplicate :/ I created a poll on CrowdSignal.com https://poll.fm/10226924 When adding a comment, there is no rate limit. You can see my comments on my poll. 1. Go to any poll. 2. Turn on Intercept and Add a Comment. 3. Send request to Intruder. 4. Set your payloads and...

bind security update

32:9.9.4-73 - Fixes debug level comments 1647539...

Lapis Reviews plugin has xss vulnerability

Lai Bili Comments Plugin is a comment management plugin that uses social networking site accounts to log in, eliminating the registration process and increasing users' willingness to engage and communicate. An xss vulnerability exists in Lai Bili Comment Plugin, which can be exploited by attacker...

DRUPAL-CONTRIB-2019-010

Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. This module does not sufficiently filter submitted content in certain circumstances...

Anti-Spam by CleanTalk - Critical - Cross site scripting and SQL Injection - SA-CONTRIB-2019-010

Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. This module does not sufficiently filter submitted content in certain circumstances...

Apache HTTP Server Use-After-Free

The vulnerability of the Apache HTTP server is related to the use of memory after it is freed during the processing of comments in the Allow and Deny directives of the .htaccess configuration file. Exploiting this vulnerability allows a remote attacker to cause a child process of the httpd to cra...

Embed Video Scripts - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Embed Video Scripts - Cross-site Script stored Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/...

Embed Video Scripts - Persistent Cross-Site Scripting

Exploit Title: Embed Video Scripts - Cross-site Script stored Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/ Software Link:...