Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
875 results · page 9 of 18
Apr 1, 2022pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.CVE-2021-44135 · Other software · Pagekit · reported by MITRECritical 9.8
pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.
- Product
- Pagekit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-1064 · Other software · forkcms · reported by security@huntr.devHigh 8.8
SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.
- Product
- forkcms/forkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php.CVE-2021-45793 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest.CVE-2022-0675 · Other software · Puppet · reported by security@puppet.comMedium 5.6
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
- Product
- Firewall Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Easy Drag And drop All Import : WP Ultimate CSV Importer: Does not sanitise and escaped imported commentsCVE-2022-0360 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
- Product
- Easy Drag And drop All Import : WP Ultimate CSV Importer
- Fixed in
- 6.4.3
- What to do
- Update Easy Drag And drop All Import : WP Ultimate CSV Importer to 6.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Is affected by a race conditionCVE-2022-0279 · WordPress plugins & themes · reported by WPScanLow 3.1
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 15, 2022An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downCVE-2021-46250 · Other software · Scratchoauth2 Project · reported by MITRECritical 10
An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
- Product
- Scratchoauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts orCVE-2022-24585 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor.CVE-2021-4035 · Other software · A3Sec · reported by cve-coordination@incibe.esLow 3.5
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
- Product
- Wocu Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of commentsCVE-2022-23889 · Other software · Yzmcms · reported by MITREMedium 5.3
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.CVE-2022-23888 · Other software · Yzmcms · reported by MITREHigh 8.8
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.CVE-2022-23435 · Computers, phones & browsers · Android-gif-drawable Project · reported by MITREHigh 7.5
decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.
- Product
- Android-gif-drawable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackerCVE-2021-44217 · Other software · Ericsson · reported by MITREMedium 6.1
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
- Product
- Codechecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodechecker-demo.eastus.cloudapp.azure.comgithub.com
Jan 17, 2022AnyComment: Has an API endpointCVE-2021-24838 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
- Product
- AnyComment
- Fixed in
- 0.3.5
- What to do
- Update AnyComment to 0.3.5 or newer.
Dec 22, 2021Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.CVE-2020-20605 · Other software · Personal Blog CMS Project · reported by MITREMedium 6.1
Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
- Product
- Personal Blog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php.CVE-2021-44935 · Other software · Glfusion · reported by MITRECritical 9.1
glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely without interaction.
- Product
- Glfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 22, 2021OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tranCVE-2021-38377 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
- Product
- Schreikasten
- Affected
- up to 0.14.18
- What to do
- Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 1, 2021Delete All Comments Easily: Is lacking Cross-Site Request Forgery (CSRF) checksCVE-2020-36505 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.
- Product
- Delete All Comments Easily
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Delete All Comments Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
- Product
- jQuery Reply to Comment
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2021SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment pCVE-2020-23048 · Other software · Seeddms · reported by MITREMedium 6.1
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2021emlog v6.0.0 contains a SQL injection via /admin/comment.php.CVE-2020-21013 · Other software · Emlog · reported by MITREHigh 7.2
emlog v6.0.0 contains a SQL injection via /admin/comment.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar SecCVE-2021-22950 · Other software · Concretecms · reported by support@hackerone.comMedium 6.5
Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orghackerone.com
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
- Product
- Comment Link Remove and Other Comment Tools
- Fixed in
- 2.1.6
- What to do
- Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 10, 2021Edit Comments XT: Reflected Cross-Site ScriptingCVE-2021-38336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Edit Comments XT
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Edit Comments XT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021A stored cross-site scripting (XSS) vulnerability in the /article/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML viCVE-2020-19294 · Other software · Jeesns · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the /article/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the article comments section.
- Product
- Jeesns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021A stored cross-site scripting (XSS) vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via CVE-2020-19290 · Other software · Jeesns · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Weibo comment section.
- Product
- Jeesns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021A stored cross-site scripting (XSS) vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via CVE-2020-19284 · Other software · Jeesns · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the group comments text field.
- Product
- Jeesns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8.CVE-2021-33484 · Other software · Onyaktech Comments Pro Project · reported by MITREHigh 7.5
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
- Product
- Onyaktech Comments Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordburninatorsec.blogspot.comtwitter.com
Sep 7, 2021An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8.CVE-2021-33483 · Other software · Onyaktech Comments Pro Project · reported by MITREMedium 5.4
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.
- Product
- Onyaktech Comments Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordburninatorsec.blogspot.comtwitter.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2021.18
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Comment Highlighter
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021Edit Comments: Does not sanitiseCVE-2021-24551 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
- Product
- Edit Comments
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Edit Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 19, 2021A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code vCVE-2021-28001 · Other software · Textpattern · reported by MITREMedium 5.4
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Aug 18, 2021Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and SpCVE-2021-20775 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege.
- Product
- Cybozu Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.CVE-2021-36455 · Other software · Naviwebs · reported by MITREHigh 8.8
SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.
- Product
- Navigate CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnavigatecms.com
Jul 12, 2021Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.CVE-2020-18982 · Other software · Halo · reported by MITREMedium 5.4
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.CVE-2020-18066 · Other software · Zrlog · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
- Product
- Zrlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2021Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla,CVE-2021-28977 · Other software · Get-simple · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Comments Like Dislike: Allows users to like/dislike posted commentsCVE-2021-24379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
- Product
- Comments Like Dislike
- Fixed in
- 1.1.4
- What to do
- Update Comments Like Dislike to 1.1.4 or newer.
Jun 21, 2021Jetpack Carousel module of the JetPack: Allows users to create a "carousel" type image gallery and allows users to comment on the imagesCVE-2021-24374 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
- Product
- Jetpack Carousel module of the JetPack
- Fixed in
- 9.8
- What to do
- Update Jetpack Carousel module of the JetPack to 9.8 or newer.
Jun 15, 2021A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolenCVE-2020-21316 · Other software · Zrlog · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.
- Product
- Zrlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 14, 2021In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.CVE-2020-23689 · Other software · Yfcmf · reported by MITREMedium 4.8
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
- Product
- Yfcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021Imagements: Allows images to be uploaded in commentsCVE-2021-24236 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.
- Product
- Imagements
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Imagements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2021Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.CVE-2021-30227 · Other software · Emlog · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment wiCVE-2020-17542 · Other software · Dotcms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
- Product
- Dotcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2021An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2.CVE-2021-31550 · Other software · Mediawiki · reported by MITREMedium 5.4
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.