31 matches found
CVE-2026-47245
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
CVE-2026-47245
In MyBB versions prior to 1.8.40, the usercp.php?action=do_editlists delete handler performs a reciprocal buddy-list update that searches for the target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. When array_search() returns false, it i...
CVE-2026-47245
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
EUVD-2026-61016
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
CVE-2026-47245 MyBB: Buddy list corruption
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
CVE-2026-45115
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...
CVE-2026-45115 MyBB: Buddy/ignore list username XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...
EUVD-2002-1645
Malware in sbrugna...
CVE-2025-46171
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum...
CVE-2025-46171
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum...
CVE-2025-46171
CVE-2025-46171 — vBulletin 3.8.7 DoS via buddylist . Multiple connected sources confirm that an authenticated user who maintains a sufficiently large buddy list can trigger excessive memory usage when the server processes the buddylist (misc.php?do=buddylist), leading to resource exhaustion and f...
CVE-2025-46171
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum...
PT-2025-30595 · Vbulletin · Vbulletin
Name of the Vulnerable Software and Affected Versions: vBulletin version 3.8.7 Description: vBulletin is susceptible to a denial-of-service condition through the misc.php?do=buddylist endpoint. Processing a large buddy list by an authenticated user can lead to excessive memory consumption,...
CVE-2025-46171
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum...
CVE-2011-5133
Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...
Clansphere CMS 2011.4 - Stored Cross-Site Scripting Vulnerability
Exploit Title: Clansphere CMS 2011.4 - Stored Cross-Site Scripting XSS Exploit Author: Sinem Şahin Vendor Homepage: https://www.csphere.eu/ Version: 2011.4 Tested on: Windows & XAMPP == Tutorial http://HOST/index.php?mod=buddys&action=create&id=925872 2- Write XSS Payload into the username of the...
Clansphere CMS 2011.4 Cross Site Scripting
Exploit Title: Clansphere CMS 2011.4 - Stored Cross-Site Scripting XSS Exploit Author: Sinem Şahin Date: 2022-10-08 Vendor Homepage: https://www.csphere.eu/ Version: 2011.4 Tested on: Windows & XAMPP == Tutorial http://HOST/index.php?mod=buddys&action=create&id=925872 2- Write XSS Payload into th...
SUSE CVE-2007-4996
libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial of service crash via a nudge message that triggers an access of "an invalid memory location."...
AOL Instant Messenger 4.x Unauthorized Actions Vulnerability
0 0 0 0 source: http://www.securityfocus.com/bid/5246/info The AOL Instant Messenger client is prone to an issue which may allow maliciously crafted HTML to perform unauthorized actions such as adding entries to the buddy list on behalf of the user of a vulnerable client. This condition is due to...
