PT-2019-9356

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.5.2 Description A privilege escalation issue was discovered in the update function of the wpForo Forum plugin. This allows a registered forum user to escalate their privileges to those of a forum...

CVE-2018-16613: Undefined Security Weakness

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction...

MyBB Cross-Site Scripting Vulnerability (CNVD-2019-18514)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB versions prior to 1.8.21. The vulnerability stems...

We can control you see the content: mainstream IPTV remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

About a year ago, Check Point Research Team found that the Ukrainian TV streaming platform, there is a serious vulnerability, once exploited, could enable service providers face a serious risk. Specifically, an attacker can get the entire customer database of personal information and financial...

Data Breach Disclosed by Online Invitation Firm Evite

Online invitation and stationary company Evite has notified customers of a data breach that stemmed from an “inactive data storage file” associated with user accounts. The company over the weekend said that during April 2019, it became aware of a “security incident involving potential unauthorize...

MyBB Cross-Site Scripting Vulnerability (CNVD-2019-16947)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB version 1.8.19, which can be exploited by attacker...

InnoGames: Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)

The referrer leaked the CSRF code, when opening an embedded PHP file set by the images function in tribe forums. Due to a premium function, which allows players to store and run Javascript scripts during the game, the session ID could be grabbed, as it was mistakenly embedded into the DOM. This...

Hackers hacked: Account hijacking forum OGUsers pwned

By Uzair Amir The stolen OGUsers database is available on RaidForums for download. On 12th May, hackers managed to steal the database of a famous hijacker forum called OGUsers. This forum is used by hackers and online account hijackers, which means that the hackers have now been given a taste of...

Cross site request forgery (csrf)

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

CVE-2019-12253 affects the project’s “my little forum” prior to version 2.4.20. The vulnerability is a CSRF flaw that allows deleting posts via a crafted request (e.g., mode=posting&delete_posting). The issue is confirmed across multiple feeds (NVD/NVD-derived entries, Red Hat advisory, OSV, CVE ...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

PT-2019-12720

Name of the Vulnerable Software and Affected Versions my little forum versions prior to 2.4.20 Description The issue allows for CSRF, enabling the deletion of posts. This can be demonstrated through the API endpoint "mode=posting&delete posting", where an attacker can manipulate the mode and dele...

CVE-2019-12253: Cross-Site Request Forgery (CSRF)

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

Account Hijacking Forum OGusers Hacked

Ogusers.com -- a forum popular among people involved in hijacking online accounts and conducting SIM swapping attacks to seize control over victims' phone numbers -- has itself been hacked, exposing the email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum...

DRUPAL-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

PT-2019-20526

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...