CVE-2018-16808: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

Insecure Authorization

libmosquitto.so is vulnerable to insecure authorization. An empty ACL file or containing only blank lines or comments is treated as not defined and no topic access would be denied. This could lead to access being incorrectly granted and allow an attacker to access or modify resources that are...

Sql injection

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587

CVE-2019-7587 affects Bo-blog Wind through 1.6.0-r. The vulnerability is a SQL Injection in the admin.php/comments/batchdel/ comID parameter, caused by mishandling in the mode/admin.mode.php delBlockedBatch function. The connected sources corroborate the issue and describe it as a SQL injection v...

PT-2019-18659

Name of the Vulnerable Software and Affected Versions Bo-blog Wind versions through 1.6.0-r Description The issue allows SQL Injection via the comID parameter in the "admin.php/comments/batchdel/" endpoint because this parameter is mishandled in the delBlockedBatch function in mode/admin.mode.php...

CVE-2019-7587: Improper Neutralization of Special Elements used in an SQL Command

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

Automattic: No Rate Limit on CrowdSignal Polls when Adding Comment

Hi team! I hope this isn't duplicate :/ I created a poll on CrowdSignal.com https://poll.fm/10226924 When adding a comment, there is no rate limit. You can see my comments on my poll. 1. Go to any poll. 2. Turn on Intercept and Add a Comment. 3. Send request to Intruder. 4. Set your payloads and...

bind security update

32:9.9.4-73 - Fixes debug level comments 1647539...

Lapis Reviews plugin has xss vulnerability

Lai Bili Comments Plugin is a comment management plugin that uses social networking site accounts to log in, eliminating the registration process and increasing users' willingness to engage and communicate. An xss vulnerability exists in Lai Bili Comment Plugin, which can be exploited by attacker...

DRUPAL-CONTRIB-2019-010

Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. This module does not sufficiently filter submitted content in certain circumstances...

Apache HTTP Server Use-After-Free

The vulnerability of the Apache HTTP server is related to the use of memory after it is freed during the processing of comments in the Allow and Deny directives of the .htaccess configuration file. Exploiting this vulnerability allows a remote attacker to cause a child process of the httpd to cra...

Anti-Spam by CleanTalk - Critical - Cross site scripting and SQL Injection - SA-CONTRIB-2019-010

Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. This module does not sufficiently filter submitted content in certain circumstances...

Embed Video Scripts - Persistent Cross-Site Scripting

Exploit Title: Embed Video Scripts - Cross-site Script stored Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/ Software Link:...

Embed Video Scripts - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Embed Video Scripts - Cross-site Script stored Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/...

Privilege Escalation

wordpress is vulnerable to privilege escalation. The attack is possible since it does not prevent the contributors from editing new comments made by users with higher privileges...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...

CVE-2018-20153

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS...