CVE-2022-1090: Improper Neutralization of Input During Web Page Generation

The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Wordpress Social Share, Social Login and Social Comments跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. Wordpress Social Share, Social Login and Social Comments has a cross-site scripting vulnerability that can be exploited by attackers to inject JavaScript and perform reflective XSS attacks...

CVE-2022-24827

Elide (Java) SQL Injection vulnerability (CVE-2022-24827) affects analytic queries that use Parameterized Columns of type TEXT in the Elide Aggregation Data Store. The issue stems from the TEXT parameter handling that can be interpreted as SQL comments (–) after a patch in 6.1.2, allowing bypass ...

CVE-2021-24987

CVE-2021-24987 affects the WordPress plugin “Social Share, Social Login and Social Comments” (WordPress Super Socializer) prior to 7.13.30. The issue is a reflected Cross‑Site Scripting vulnerability in the_champ_sharing_count AJAX action, where the urls parameter is not sanitized/escaped before ...

PT-2022-9549

Name of the Vulnerable Software and Affected Versions The Social Share, Social Login and Social Comments Plugin WordPress plugin versions prior to 7.13.30 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the urls parameter in the the champ sharing...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. Wordpress Social Share, Social Login and Social Comments has a cross-site scripting vulnerability that can be exploited by attackers to inject JavaScript and perform reflective XSS attacks...

CVE-2021-24987: Improper Neutralization of Input During Web Page Generation

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its thechampsharingcount AJAX action available to both unauthenticated and authenticated users before outputting it back in the response, leading to a...

CVE-2022-27063

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

Cross site scripting

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

CVE-2022-27063

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

PT-2022-18201

Name of the Vulnerable Software and Affected Versions AeroCMS version 0.0.1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field, exploiting a stored cross-site scripting XSS vulnerability in the view all...

CVE-2022-27063: Improper Neutralization of Input During Web Page Generation

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

Sqlparse DoS

The vulnerability of the SQL parser’s formatting module for Python Sqlparse is related to the incorrect handling of multiple occurrences of the "\r\n" character in SQL comments. Exploiting this vulnerability allows an attacker to cause service failures remotely...

CVE-2022-1190

Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...

CVE-2022-24813

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository...

CVE-2022-24813

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the "master" branch of CreateWiki's GitHub repository...

CVE-2022-24813 Authentication Bypass Using an Alternate Path or Channel in CreateWiki

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository...

WordPress Social comments by WpDevArt plugin <= 2.4.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Mika in WordPress Social comments by WpDevArt plugin versions = 2.4.9. Solution Update the WordPress Social comments by WpDevArt plugin to the latest available version at least 2.5.0...

Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC Put the following payload in any of the plugin's text field settings such as Title , Title font-size etc: "...