XSS Vulnerability in FishLeap CMS Frontend Comments List

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comment list of FishCare CMS, which can be exploited by an attacker to obtain an administrator cookie...

XSS Vulnerability in Fish Leap CMS Frontend at Comments

Fish CMS is a content management system developed by the official Catfish CMS specifically for enterprise applications. An XSS vulnerability exists in the front-end comments of FishCenter CMS, which can be exploited by an attacker to obtain an administrator cookie...

Vanilla: Hidden Stored XSS in nested post embeds

Summary: Comments can be crafted in a way that when quoted will trigger a hidden stored XSS payload. Requires initial user interaction. Description: When quoting a comment, an attacker can edit the insert embed-external data url field to contain a string which when parsed, can result in the...

Vanilla: Stored XSS in Profile Comments

Summary: The Profile Comments page which is responsible for listing a profile's recent comments is vulnerable to stored XSS as it renders the contents of recent comments without sanitizing them. Steps to reproduce: 1. Ensure you are logged in to a user account no special permissions are needed 2...

Jfinal cms xss vulnerability at frontend comments

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Support for multi-site , oauth2 authentication , account registration , password encryption , comments and replies , message alerts , site visits...

ALPINE-CVE-2018-12550

When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty...

UBUNTU-CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

PT-2019-16744

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.6.3 moodle versions prior to 3.5.5 moodle versions prior to 3.4.8 moodle versions prior to 3.1.17 Description A vulnerability was found where links within assignment submission comments would open directly in the sam...

CVE-2019-3850: URL Redirection to Untrusted Site

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

WordPress 5.1 CSRF lead to remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

Report number: B6-2019-031301 Report source: 360-CERT The authors of the report: a 360-CERT Update date: 2019-03-13 0x00 vulnerability background 2019 03 May 13, 360 CERT monitoring to RIPSTECH released WordPress 5.1 CSRF vulnerability leads to remote code execution the contents of the details...

WordPress Cross-Site Request Forgery Vulnerability (CNVD-2020-28775)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 5.1.1, which stems from the program's failure t...

New WordPress Flaw Lets Unauthenticated Remote Attackers Hack Sites

If for some reason your WordPress-based website has not yet been automatically updated to the latest version 5.1.1, it's highly recommended to immediately upgrade it before hackers could take advantage of a newly disclosed vulnerability to hack your website. Simon Scannell, a researcher at RIPS...

Cross-Site Scripting (XSS)

github.com/Dolibarr/dolibarr is vulnerable to cross-site scripting XSS. A remote attacker is able to store and inject arbitrary Javascript into a victimm's browser via the comments and public or private notes, which executes in the context of the user's browser when the comments or notes are load...

UBUNTU-CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

PT-2019-9375

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1 Description The issue concerns Stored XSS in the expense reports plugin. It occurs via the comments parameter, or a public or private note, in the expensereport/card.php file. Recommendations For versions prior...

CVE-2018-16808: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...