Simple Machines Forum Code Injection Vulnerability

Simple Machines Forum SMF is an open source web forum system by the SMF team in the United States. A security vulnerability exists in SMF version 2.0.4. An attacker can exploit the vulnerability to inject PHP code with the help of the 'dictionary' parameter...

City Union website building system message platform exists xss vulnerability

City Union is a local portal alliance website organized by Beijing City Union Technology Co. City Union forum system message platform there are xss vulnerabilities, attackers use loopholes in the page to insert malicious js code, access to user cookies and other information, resulting in user...

Code injection

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

Cross site scripting

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

CVE-2013-7466

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7468

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

CVE-2013-7467

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

CVE-2013-7466

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7467

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

PT-2019-7016

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows for XSS via the index.php?action=pm;sa=settings;save sa parameter. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions...

PT-2019-7015

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows for local file inclusion, which can result in remote code execution. This is achieved through directory traversal in the db type parameter of the install.php file. The...

PT-2019-7017

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows PHP code injection through the index.php?action=admin;area=languages;sa=editlang API endpoint, specifically via the dictionary parameter. Recommendations For version 2.0.4,...

CVE-2013-7468: Improper Control of Generation of Code

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

CVE-2013-7466: Improper Limitation of a Pathname to a Restricted Directory

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7467: Improper Neutralization of Input During Web Page Generation

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 72.0.3626.122 Platform version: 11316.165.0 for most Chrome OS devices. This build contains a number of bug fixes, security updates and feature enhancements. A list of changes can be found here, including a fix for CVE-2019-5786. If you find new issues, plea...

Cross site scripting

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

CVE-2019-8279

CVE-2019-8279 is a vulnerability in Vanilla Forums prior to 2.5 identified as multiple stored XSS in forum messages. The underlying issue is that arbitrary JavaScript could be injected into messages, enabling remote attackers to execute code in a user’s browser. The connected documents confirm th...

LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)

LayerBB 1.1.2 - Cross-Site Request Forgery Add Admin Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description:...

LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)

Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description: LayerBB is a free open-source forum software, the CSRF...