CVE-2015-3438

Multiple cross-site scripting XSS vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a 1 four-byte UTF-8 character or 2 invalid character that reaches the database layer, as demonstrated by a crafted...

DEBIAN-CVE-2015-3440

Cross-site scripting XSS vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type...

phpVibe 4.20 Stored XSS Vulnerability

Exploit for php platform in category web applications phpVibe The vulnerability exists because the user input is not properly sanitized and this can lead to malicious code injection that will be executed on the target’s browser -- Proof of Concept -- 1. The attacker posts a new comment which...

PT-2015-5527

Name of the Vulnerable Software and Affected Versions IBM Case Manager version 5.2.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Error dialog. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via crafted inpu...

phpVibe 4.20 - Persistent Cross-Site Scripting

phpVibe 4.20 - Persistent Cross-Site Scripting phpVibe The vulnerability exists because the user input is not properly sanitized and this can lead to malicious code injection that will be executed on the target’s browser -- Proof of Concept -- 1. The attacker posts a new comment which contains ou...

CVE-2015-1979: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the 1 addressability or 2 comments component...

WordPress Subscribe To Comments 2.1.2 LFI / Code Execution Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: Subscribe to Comments Version: 2.1.2 Homepage: http://wordpress.org/plugins/subscribe-to-comments/ Advisory report:...

phpVibe Stored Cross Site Scripting

phpVibe The vulnerability exists because the user input is not properly sanitized and this can lead to malicious code injection that will be executed on the target’s browser -- Proof of Concept -- 1. The attacker posts a new comment which contains our payload: " 2. The stored XSS can be triggered...

WordPress Subscribe To Comments 2.1.2 LFI / Code Execution

Details ================ Software: Subscribe to Comments Version: 2.1.2 Homepage: http://wordpress.org/plugins/subscribe-to-comments/ Advisory report: https://security.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/ CVE: Awaiting...

WordPress Subscribe to Comments Plugin <= 2.1.2 - Local File Inclusion

Because of this vulnerability, administrators can upload PHP files, also, they can perform arbitrary code execution by the same method. Solution Update the plugin...

Suspicious PDF Comment Field

This protection detects suspicious content inside the comment field in PDF files...

CVE-2015-4336

cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file...

PT-2015-6522

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.2 Description The issue allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters. This can be achieved by using the backup comments feature to create t...

CVE-2015-4386: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing 1 comments, 2 taxonomy terms, or 3 nodes...

Easy Author Image 1.5 - Email Disclosure

When the plugin, "Easy Author Image" is used in a Wordpress site to handle user comments, what it does is put the email address of the commentator in the "alt" field of the user's avatar...

WordPress 4.2 stored XSS

OVERVIEW ========== Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If triggered by a logged-in administrator, under default settings the attacker can leverag...

PT-2015-6229

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.1 Description A cross-site scripting XSS issue exists due to improper storage of long comments in the MySQL database, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For version...

WordPress < 4.2.1 Comments Stored XSS Vulnerability

WordPress is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress <= 3.9.5 / 4.1.x < 4.1.4 / 4.2.x < 4.2.1 Comments Stored XSS

According to its version number, the WordPress application running on the remote web server is affected by an input validation flaw that allows an unauthenticated attacker to inject JavaScript into WordPress comments, which could result in a stored cross-site scripting attack being carried out wh...

Hacking WordPress Website with Just a Single Comment

Most of the time, we have reported about WordPress vulnerabilities involving vulnerable plugins, but this time a Finnish security researcher has discovered a critical zero-day vulnerability in the core engine of the WordPress content management system. Yes, you heard it right. The WordPress CMS...