Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
875 results · page 7 of 18
Mar 7, 2024In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleCVE-2024-28228 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 5, 2024The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.CVE-2024-24784 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
- Product
- net/mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.gCVE-2024-25983 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.5
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 12, 2024User ID references at mentions in document comments were not correctly sanitized.CVE-2023-41703 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Feb 12, 2024Honeypot for WP Comment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24933 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prasidhda Malla Honeypot for WP Comment allows Reflected XSS.This issue affects Honeypot for WP Comment: from n/a through 2.2.3.
- Product
- Honeypot for WP Comment
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Honeypot for WP Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024Comments – wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51691 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.6.12
- What to do
- Affects up to 7.6.12. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 29, 2024When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user.CVE-2024-23792 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more files to the comment. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024ark-commenteditor: Does not properly sanitise or encode the commentsCVE-2021-4227 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
- Product
- ark-commenteditor
- Affected
- up to 2.15.6
- What to do
- Affects up to 2.15.6. Update ark-commenteditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2024CommentTweets: Does not have CSRF checks in some placesCVE-2023-6845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- CommentTweets
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update CommentTweets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Dec 21, 2023An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token.CVE-2023-51380 · Other software · GitHub · reported by product-cna@github.comLow 2.7
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 21, 2023An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token.CVE-2023-51379 · Other software · GitHub · reported by product-cna@github.comMedium 4.9
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 20, 2023Comments – wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2023-46311 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.6.3
- What to do
- Affects up to 7.6.3. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooDiscuz – WooCommerce Comments: Cross-Site Request Forgery (CSRF)CVE-2023-49759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.
- Product
- WooDiscuz – WooCommerce Comments
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023CommentLuv: Server-Side Request Forgery (SSRF)CVE-2023-49159 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.
- Product
- CommentLuv
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update CommentLuv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missedCVE-2023-50871 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 5, 2023A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other usCVE-2023-28876 · Other software · Afian · reported by MITREMedium 4.3
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
- Product
- Filerun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilerun.comherolab.usd.de
Nov 30, 2023Bulk Comment Remove: Cross-Site Request Forgery (CSRF)CVE-2023-48330 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2.
- Product
- Bulk Comment Remove
- Affected
- up to 2
- What to do
- Affects up to 2. Update Bulk Comment Remove to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.CVE-2023-49146 · Other software · Getgrav · reported by MITREMedium 6.1
DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.
- Product
- Dom-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.CVE-2023-47775 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.
- Fixed in
- 7.6.12
- What to do
- Update the plugin to 7.6.12 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.CVE-2023-5544 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Commenter Emails: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45360 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.
- Product
- Commenter Emails
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Commenter Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Copy or Move Comments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28748 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This issue affects Copy or Move Comments: from n/a through 5.0.4.
- Product
- Copy or Move Comments
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update Copy or Move Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List oCVE-2023-45540 · Other software · Jorani · reported by MITREMedium 6.5
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.
- Product
- Leave Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.CVE-2023-45654 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 13, 2023MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra fCVE-2023-45853 · Other software · zlib · reported by MITRECritical 9.8
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
- Product
- zlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 29, 2023Comments by Startbit: Stored Cross-Site ScriptingCVE-2023-5295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Comments by Startbit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Comments by Startbit
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Comments by Startbit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 27, 2023In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.CVE-2023-30959 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.1
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
- Product
- com.palantir.apollo:autopilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Sep 8, 2023The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.CVE-2023-39318 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment toCVE-2023-41161 · Other software · Webmin · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023Comments Like Dislike: Unauthorized modification of dataCVE-2023-3244 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: this issue is was only partially patched in version 1.2.0, as the nonce is still present to subscriber-level users.
- Product
- Comments Like Dislike
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2023Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment FieldCVE-2022-46485 · Other software · Ngsurvey · reported by MITREHigh 7.5
Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".
- Product
- Ngsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023Vuukle Comments, Reactions, Share Bar, Revenue: Cross-Site Request ForgeryCVE-2021-4427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. This is due to missing or incorrect nonce validation in the /admin/partials/free-comments-for-wordpress-vuukle-admin-display.php file. This makes it possible for unauthenticated attackers to edit the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Vuukle Comments, Reactions, Share Bar, Revenue
- Affected
- up to 3.4.31
- What to do
- Affects up to 3.4.31. Update Vuukle Comments, Reactions, Share Bar, Revenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions.CVE-2023-25051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.CVE-2023-23704 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.
- Fixed in
- 1.1.7
- What to do
- Update the plugin to 1.1.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew theCVE-2023-30956 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 5.3
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
- Product
- com.palantir.comments:comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jun 20, 2023Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.CVE-2020-21268 · Other software · Easycorp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment fCVE-2020-21052 · Other software · Zrlog · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function.
- Product
- Zrlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 8, 2023Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.CVE-2023-34961 · Other software · Chamilo · reported by MITREMedium 6.1
Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.chamilo.org
Jun 6, 2023Delete All Comments: Arbitrary file uploadsCVE-2016-15033 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- Delete All Comments
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Delete All Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 6, 2023A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks.CVE-2023-30948 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content. This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.
- Product
- com.palantir.comments:comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
May 31, 2023Display post meta, term meta, comment meta, and user meta: Stored Cross-Site ScriptingCVE-2023-1661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Display post meta, term meta, comment meta, and user meta
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Display post meta, term meta, comment meta, and user meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
May 28, 2023WooDiscuz – WooCommerce Comments: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33216 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.
- Product
- WooDiscuz – WooCommerce Comments
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 28, 2023SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-26781 · Other software · Chshcms · reported by MITRECritical 9.8
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.CVE-2012-5872 · Other software · Arc2 Project · reported by MITRECritical 9.8
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
- Product
- Arc2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_content parameters at /poCVE-2023-29847 · Other software · Aerocms Project · reported by MITREMedium 5.4
AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_content parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Aerocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.CVE-2020-20521 · Other software · Kitesky · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.
- Product
- Kitecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.