Decryptor Keys Published for Maze, Egregor, Sekhmet Ransomwares

The shackles have been broken for victims of Maze/Egregor/Sekhmet ransomware: On Wednesday, decryption keys were released for all three ransomware strains in a forum post. The liberator, using the handle “Topleak,” described themselves as the developer of the three ransomwares. It’s been lovely,...

HYBBS 默认配置问题漏洞

HYBBS is a lightweight community forum program. A default configuration issue vulnerability exists in HYBBS, which stems from the product writing plugin-related configuration information to conf.php. An attacker can use this vulnerability to execute code on the Admin.php page. The following...

CVE-2022-23602

CVE-2022-23602 affects Nimforum prior to 2.2.0. A user can create a thread/post with an include pointing to a local file, causing Nimforum to render the file; this can also be triggered via the post preview endpoint. Consequence includes exposure of sensitive data such as forum.json secrets. Vers...

WordPress Asgaros Forum plugin <= 1.15.20 - Blind SQL Injection (SQLi) vulnerability

Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Asgaros Forum plugin versions = 1.15.20. Solution Update the WordPress Asgaros Forum plugin to the latest available version at least 2.0.0...

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

The plugin does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection PoC As any authenticated user, such as subscriber To get the nonce:...

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

The plugin does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection As any authenticated user, such as subscriber To get the nonce: /wp-admin/admin-ajax.php?action=rest-nonc...

Mageia: Security Advisory (MGASA-2014-0379)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2014-0160)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSRF vulnerability in jupyter-server-proxy

Impact What kind of vulnerability is it? Server-Side Request Forgery SSRF Who is impacted? Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the allowedhos...

WordPress Asgaros Forum plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in versions of the WordPress plugin Asgaros Forum prior to 1.15.15, which...

Uscat 跨站脚本漏洞

Uscat is a forum system based on Javaex + Ssm development. A cross-site scripting vulnerability exists in uscat, which stems from a cross-site scripting XSS vulnerability in the close registration information input box of uscat...

Uscat 跨站脚本漏洞

Uscat is a forum system based on Javaex + Ssm development. A cross-site scripting vulnerability exists in uscat, which stems from an input box via statistical code that is susceptible to cross-site scripting XSS attacks...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

Sql injection

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

CVE-2021-25045

CVE-2021-25045 affects the WordPress Asgaros Forum plugin prior to 1.15.15. The vulnerability is an SQL injection in the admin path: the plugin does not validate or escape the forum_id parameter before using it in SQL when editing a forum. This can allow an attacker to inject SQL via the forum_id...

CVE-2021-25045 Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

WordPress plugin SQL注入漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in versions of the WordPress plugin Asgaros Forum prior to 1.15.15, which...

CVE-2021-25045: Improper Neutralization of Special Elements used in an SQL Command

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...