CVE-2021-33483

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment...

CVE-2021-33484

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted...

CVE-2021-33483

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment...

CVE-2021-33484

OnyakTech Comments Pro 3.8 is affected in its CommentsService.ashx. An attacker can decompile the installer to find a hardcoded IV used to encrypt usernames and user IDs in the comment POST request, and can decrypt the encryption key by setting the encrypted value as the username, revealing the d...

CVE-2021-33484

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted...

CVE-2021-33483

OnyakTech Comments Pro 3.8 contains a Cross-Site Scripting (XSS) vulnerability in CommentsService.ashx, where the comment posting functionality accepts a JSON payload that can carry an XSS payload. When users view the page with the affected comment, the attacker-controlled script can execute in t...

CVE-2021-33484: Use of Hard-coded Credentials

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted...

CVE-2021-33483: Improper Neutralization of Input During Web Page Generation

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment...

PT-2021-20146

Name of the Vulnerable Software and Affected Versions OnyakTech Comments Pro version 3.8 Description An issue in CommentsService.ashx allows an attacker to add an XSS payload to the JSON request, which will execute when users visit the page with the comment. This affects the comment posting...

OnyakTech Comments Pro Cross-site Scripting Vulnerability

OnyakTech Comments Pro has been building DNN modules since 2003. A cross-site scripting vulnerability exists in OnyakTech Comments Pro, which stems from the comment function in the product's CommentsService.ashx page not securely validating json requests. The vulnerability can be exploited to...

PT-2021-20147

Name of the Vulnerable Software and Affected Versions OnyakTech Comments Pro version 3.8 Description An issue was discovered in CommentsService.ashx. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment...

PT-2021-16039

Name of the Vulnerable Software and Affected Versions The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2021.18 Description The issue allows high privilege users, such as admins, to set Cross-Site Scripting payloads in some settings, even when the...

CVE-2021-24551

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

CVE-2021-24551

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

CVE-2021-24551

CVE-2021-24551 affects the WordPress Edit Comments plugin (version

PT-2021-16071

Name of the Vulnerable Software and Affected Versions Edit Comments WordPress plugin versions 0.3 and earlier Description The issue arises from the lack of sanitization, validation, or escaping of the jal edit comments GET parameter before its use in a SQL statement, leading to a SQL injection...

CVE-2021-24551: Improper Neutralization of Special Elements used in an SQL Command

The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jaleditcomments GET parameter before using it in a SQL statement, leading to a SQL injection issue...

WordPress Plugin Edit Comments SQL Injection Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. Wordpress Plugin Edit Comments suffers from a SQL...

CVE-2021-28001

A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting...

PT-2021-17707

Name of the Vulnerable Software and Affected Versions: Textpattern CMS version 4.8.4 Description: A cross-site scripting issue was discovered in the Comments parameter, allowing remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The issue is triggered by...