CVE-2024-28234 Contao has insufficient BBCode sanitizer

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. A...

CVE-2024-28234 Contao has insufficient BBCode sanitizer

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. A...

CVE-2024-28234 Contao has insufficient BBCode sanitizer

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. A...

CVE-2024-28234

Contao is affected when BBCode is enabled for comments, allowing CSS injection via BBCode in user comments. The issue affects Contao 2.0.0 and earlier, and versions prior to 4.13.40 and 5.3.4. Patch versions are Contao 4.13.40 and 5.3.4, which fix the vulnerability. As a workaround, disable BBCod...

Contao 安全漏洞

Contao is an open source content management system CMS developed in PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 4.x prior to version 4.13.40 and version 5.x prior to version 5.3.4, which stems from the ability t...

PT-2024-22349 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions 2.0.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3 Description: The issue allows injection of CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled for comments. Recommendations: For...

WordPress Subscribe To Comments Reloaded plugin <= 220725 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Subscribe To Comments Reloaded versions = 220725...

WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WordPress Comments Import & Export versions = 2.3.5...

WordPress Subscribe To Comments Reloaded Plugin <= 220725 is vulnerable to Sensitive Data Exposure

Software Subscribe To Comments Reloaded Type Plugin Vulnerable versions = 220725 Fixed in 240119 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31249 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 45c0e6e3acea...

PT-2024-25293 · Sourcecodester · Sourcecodester Aplaya Beach Resort Online Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Aplaya Beach Resort Online Reservation System version 1.0 Description: A critical issue has been discovered, affecting the file admin/mod comments/index.php. The manipulation of the id argument leads to SQL injection. This issu...

Aplaya Beach Resort Online Reservation System 安全漏洞

Aplaya Beach Resort Online Reservation System is the online room reservation system for Aplaya Beach Resort. A security vulnerability exists in SourceCodester Aplaya Beach Resort Online Reservation System version 1.0, which originates from an SQL injection in the id parameter of the...

WordPress WordPress Comments Import & Export Plugin <= 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress Comments Import & Export Type Plugin Vulnerable versions = 2.3.5 Fixed in 2.3.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31235 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8fb386b6b6f3 Credits...

Better Comments < 1.5.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. From the WordPress menu on the left...

CVE-2024-26495

CVE-2024-26495 affects Friendica versions after 2023.12. The vulnerability is Cross Site Scripting (XSS) in BBCode handling for post content and comments, enabling a remote attacker to obtain sensitive information. The root cause is an XSS flaw in processing BBCode; exploitation details are not p...

Authorization Bypass

moodle/moodle is vulnerable to Authorization Bypass. The vulnerability is due to insufficient permission checks, which allow unauthorized users to add comments to the comments block on another user's dashboard when it is not otherwise available...

CVE-2024-30555 WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & Lazy Load: from n/a through 1.4.8...

CVE-2024-30555 WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & Lazy Load: from n/a through 1.4.8...

CVE-2024-30555

CVE-2024-30555 describes an Stored XSS in the plugin “Ultimate Social Comments – Email Notification & Lazy Load” due to Improp er Neutralization of Input During Web Page Generation . Affected range is listed as from n/a through 1.4.8 ; no public details on a fixed version are provided in the supp...

BIT-MOODLE-2024-25983 Msa-24-0006: idor on dashboard comments block

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available e.g., on their profile page...

PT-2024-23485 · Unknown · Ultimate Social Comments – Email Notification & Lazy Load

Name of the Vulnerable Software and Affected Versions: Ultimate Social Comments – Email Notification & Lazy Load versions 1.4.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability,...