Sql injection

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

PT-2015-3678

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related...

comments.club.cnews.ru XSS vulnerability

Open Bug Bounty ID: OBB-53116 Description| Value ---|--- Affected Website:| comments.club.cnews.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

CVE-2014-8724

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

PT-2014-8691 · Frederick Townes · W3 Total Cache

Name of the Vulnerable Software and Affected Versions: W3 Total Cache plugin versions prior to 0.9.4.1 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the Cache key in the HTML-Comments when debug...

W3 Total Cache <= 0.9.4 - Debug Mode XSS

If debug mode is enabled an XSS vector exists in the HTML comments...

Security advisory for Bugzilla 4.5.6, 4.4.6, 4.2.11, and 4.0.15

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: The 'realname' parameter is not correctly filtered on user account creation, which could lead to user data override. Several...

MGASA-2014-0412 Updated bugzilla packages fix security vulnerabilities

Updated bugzilla packages fix security vulnerabilities: If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group CVE-2014-1571. An attacker creating a new Bugzil...

Updated bugzilla packages fix security vulnerabilities

Updated bugzilla packages fix security vulnerabilities: If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group CVE-2014-1571. An attacker creating a new Bugzil...

Arachni Web Application Scanner Web UI - Stored XSS Vulnerability

No description provided by source. Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability CVE: 2014-5469 Vendor Homepage: http://www.arachni-scanner.com/ Author: Prakhar Prasad Author Homepage: https://prakharprasad.com Reference: https://github.com/Arachni/arachni-ui-web/issues/7...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

NOSpamPTI 2.1 - wp-comments-post.php comment_post_ID Parameter SQL Injection

The nospampti WordPress plugin was affected by a wp-comments-post.php commentpostID Parameter SQL Injection security vulnerability...

Featured Comments 1.2.1 - wp-admin/admin-ajax.php Comment Status Manipulation CSRF

The Featured Comments WordPress plugin was affected by a wp-admin/admin-ajax.php Comment Status Manipulation CSRF security vulnerability...

Subscribe To Comments Reloaded 140204 - options/index.php manager_page Parameter Stored XSS Weakness

The Subscribe To Comments Reloaded WordPress plugin was affected by an options/index.php managerpage Parameter Stored XSS Weakness security vulnerability...

WordPress Subscribe To Comments Reloaded Plugin <= 140204 - CSRF

This plugin is prone to an options/index.php admin settings manipulation CSRF vulnerability. It allows to perform unauthorized actions in the context of a logged-in user of the affected application. Solution Update the plugin...

PT-2014-6228

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.2.x through 4.2.5 Description A cross-site scripting XSS issue exists due to improper handling of crafted table comments during the construction of a database structure page. This allows remote authenticated users to inje...

Design/Logic Flaw

The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was...

CVE-2013-4273

The Drupal Entity API module (7.x-1.x) before 7.x-1.2 fails to properly enforce access restrictions for node comments when used with Views field/area plugins, allowing remote authenticated users to read restricted comments via a View (and is split from CVE-2013-4273’s View vector). The issue spec...

CVE-2013-4273

The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was...