BuddyBoss Security Breach

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A security vulnerability exists in version 2.2.9 of BuddyBoss that stems from allowing authenticated users to access and rename other users' photo albums...

BuddyBoss Cross-Site Scripting Vulnerability

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. A cross-site scripting vulnerability exists in BuddyBoss version 2.2.9 that originates from allowing a local attacker to execute a malicious payload via the name=image.jpg parameter...

CVE-2021-43334

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-43334

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

Cross site scripting

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field...

Default configuration

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. email protected wou...

CVE-2021-43334

CVE-2021-43334 affects BuddyBoss Platform (≤ 1.8.0) with a Cross-site Scripting (XSS) vulnerability in the Group Name/Group Description fields. The root cause is a lack of input validation in the bp_register_active_group_types function within bp-groups-functions.php, leading to script injection. ...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-44692

The CVE describes a vulnerability in BuddyBoss Platform up to version 1.8.0 where user emails can be inferred and exposed. When a new user is created, a UID is generated for the profile, which encodes the user’s private email address (symbols removed, periods replaced with hyphens). The resulting...

BuddyBoss Platform 信息泄露漏洞

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss for running online communities on WordPress. BuddyBoss Platform has a security vulnerability that can be exploited by a remote attacker to obtain each user's email address...

BuddyBoss Platform 跨站脚本漏洞

BuddyBoss Platform is a state-of-the-art plugin from BuddyBoss that runs online communities on WordPress. A cross-site scripting vulnerability exists in BuddyBoss Platform that stems from BuddyBoss Platform allowing XSS via the Group Name or Group Description fields...