WordPress WP Photo Album Plus plugin < 9.3.04.004 - Photo Comment Deletion vulnerability

Photo Comment Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Photo Album Plus versions 9.3.04.004...

CVE-2026-14922: Improper Neutralization of Input During Web Page Generation

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

Pornhub: Stored XSS in photo comment functionality

The photo comment functionality is vulnerable to stored cross site scripting: an attacker can craft a comment that contains malicious code and get it stored. This can be reproduced on my test account at http://www.pornhub.com/photo/166952961. Interestingly, differently from 171901 where i could...

Exhibit Engine <= 1.5 RC 4 (photo_comment.php) File Include Exploit

Exploit for unknown platform in category web applications =================================================================== Exhibit Engine = 1.5 RC 4 photocomment.php File Include Exploit =================================================================== ' ' EXPLOIT coded by Kacper in Visual...

[SECURITY] New version of Netscape Communicator/Navigator released

Package: netscape communicator, navigator Vulnerability: remote exploit Debian-specific: no Existing Netscape Communicator/Navigator packages contain the following vulnerabilities: 1. Netscape Communicator JPEG-Comment Heap Overwrite Vulnerability - executes arbitrary code in the comment field of...