SQL injection through marking blog comments on bulk as spam

Description the comments ids aren't checked and vulnerable for SQL injection Proof of Concept...

Valorant cheats on YouTube are actually information-stealing malware

Valorant, the popular free-to-play team based shooter, is attracting the attention of scammers. It’s reported that a malware distribution campaign is leveraging YouTube to push infection files. The campaign distributes a file known for password theft, and hunts for those passwords in browsers,...

YzmCMS uncontrolled recursion vulnerability

Yzmcms is an open source CMS content management system for Yzmcms individual developers. an uncontrolled recursive vulnerability exists in YzmCMS v6.3, which stems from the fact that the comment function can operate concurrently and an attacker can use this vulnerability to create an unusually...

Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists in saveCommentEdit function of AdminCommentController.php because this allows HTML tags in the blog comments which allows a malicious attacker to inject and execute html payloads...

Microweber 代码注入漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber before 1.3, which stems from t...

Improper Neutralization of Special Elements Used in a Template Engine

Description The Microweber application allows HTML tags in the "Blog Comments" which can be exploited by Injecting HTML payloads. Proof of Concept 1.Open any blog in which comment is allowed. 2.Insert your html code in code block. e.g., Hurry Up!Go to https://evil.com and get free $1000 in your...

WordPress WP Ultimate CSV Importer plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Ultimate CSV Importer plugin prior to 6.4.3...

CVE-2022-0360

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

WordPress Comments Not Replied To plugin < 1.5.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Comments Not Replied To plugin versions 1.5.2. Solution Update the WordPress Comments Not Replied To plugin to the latest available version at least 1.5.2...

WordPress Comments Not Replied To plugin < 1.5.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Comments Not Replied To plugin versions 1.5.2. Solution Update the WordPress Comments Not Replied To plugin to the latest available version at least 1.5.2...

WordPress Delete All Comments of wordpress plugin <= 4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Delete All Comments of wordpress plugin versions = 4.2. Solution Update the WordPress Delete All Comments of wordpress plugin to the latest available version at least 4.3...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Ultimate CSV Importer plugin prior to 6.4.3...

WordPress Better Comments plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Better Comments plugin versions = 1.3. Solution Update the WordPress Better Comments plugin to the latest available version at least 1.4...

WordPress Internal Comments plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Internal Comments plugin versions = 1.2.2. Solution Update the WordPress Internal Comments plugin to the latest available version at least 1.2.3...

PT-2022-13125 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer WordPress plugin versions prior to 6.4.3 Description: The issue allows high privilege users to import malicious comments, potentially leading to Stored Cross-Site Scripting issues, due to the lack of sanitization and...

WordPress Better Comments plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Better Comments plugin versions = 1.3. Solution Update the WordPress Better Comments plugin to the latest available version at least 1.4...

WordPress Delete All Comments of wordpress plugin <= 4.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Delete All Comments of wordpress plugin versions = 4.2. Solution Update the WordPress Delete All Comments of wordpress plugin to the latest available version at least 4.3...

GitLab Enterprise Edition和GitLab Community Edition 资源管理错误漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A resource management error vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition, which arises from user-supplied input in user...

WordPress Internal Comments plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Internal Comments plugin versions = 1.2.2. Solution Update the WordPress Internal Comments plugin to the latest available version at least 1.2.3...

PeerTube licensing issue vulnerability

PeerTube is a decentralized video sharing service platform. It is used to create video projects. versions of PeerTube prior to 4.1.0 contain an authorization issue vulnerability that can be exploited by attackers to create new comments or reply to comments in private videos...