CVE-2023-54351: Improper Neutralization of Input During Web Page Generation

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored an...

NOSpamPTI 2.1 - wp-comments-post.php comment_post_ID Parameter SQL Injection

The nospampti WordPress plugin was affected by a wp-comments-post.php commentpostID Parameter SQL Injection security vulnerability...

CVE-2013-5917

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

CVE-2013-5917

The CVE-2013-5917 entry concerns the WordPress NOSpamPTI plugin (version 2.1). The vulnerability is a SQL injection in wp-comments-post.php via the comment_post_ID parameter, enabling remote attackers to manipulate the database and potentially exfiltrate data. Multiple connected sources confirm t...

CVE-2013-5917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

PT-2013-5868

Name of the Vulnerable Software and Affected Versions NOSpam PTI plugin version 2.1 for WordPress Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the comment post ID parameter in the wp-comments-post.php file. Recommendations For NOSpam PTI...

WordPress NOSpamPTI 2.1 Blind SQL Injection

NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira http://bit.ly/d38gB8, but some themes do not support changes to the functions.php to this we alter this function...

DEBIAN-CVE-2012-2404

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2404: Improper Neutralization of Input During Web Page Generation

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

WordPress <= 3.3.1 - XSS #1

This vulnerability is in the wp-comments-post.php. It allows the attackers to conduct XSS attacks via unspecified vectors. Solution Update WordPress...

CVE-2012-0287: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected"...

WordPress <= 3.3.0 - XSS

Because of this vulnerability in wp-comments-post.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

CVE-2009-4789: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 wp-comments-post.php and 2 wp-trackback.php...

WordPress 'wp-comments-post.php'跨站脚本漏洞

WordPress 2.8.1 WordPress是一款流行的blog系统。 WordPress 'wp-comments-post.php'不正确处理用户输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 'wp-comments-post.php'脚本对评注信息缺少过滤，提交恶意脚本代码并诱使用户访问可导致获得目标用户浏览器COOKIE等敏感信息。 Bugraq ID: 35797 CNCAN ID：CNCAN-2009072508 厂商解决方案 目前没有解决方案提供： http://wordpress.org/...

WordPress 2.8.1 - url Cross-Site Scripting

WordPress 2.8.1 - url Cross-Site Scripting !/bin/bash echo "wp281.quickprz // iso^kpsbr" SITE=$1 COMMENT=$2 MESSAGE="h4x0riZed by the superfreakaz0rz" if "X$SITE" = "X" ; then echo "$0 postID" echo "f.e. $0 www.worstpress.eu" exit fi if "X$POSTID" = "X" ; then POSTID=1 fi echo "+ building payload...

CVE-2006-4992: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in JD-WordPress for Joomla! comjd-wp 2.0-1.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter in 1 wp-comments-post.php, 2 wp-feed.php, or 3 wp-trackback.php...