Dumb0

Dumb0 A simple tool to dump users forums popular forums and CMS WordPress, SMF, vBulletin, IP Board, XEN forums, myBB, useBB, vanilla, bbPress.... Supported 27 forums/CMS help us to grow the number!: root@kitploit: SMF -- Simple Machine Forums IPB -- Invision Power Board XEN -- Xen Foro VB --...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

CVE-2026-77143

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

EUVD-2026-65333

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...

wpForo Forum <= 2.4.14 - SQL Injection

wpForo Forum WordPress plugin = 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-1581 info: name: wpForo Forum = 2.4.14 - SQL Injection author: Shivam Kamboj...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress Asgaros Forum <1.15.13 - SQL Injection

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

Orange Forum 1.4.0 - Open Redirect

Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-14474 info: nam...

WordPress wpForo Forum < 1.9.7 - Open Redirect

WordPress wpForo Forum 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. id: CVE-2021-24406 info: name: WordPress wpForo Forum 1.9.7 - Open...

CVE-2022-31296

CVE-2022-31296 Online Discussion Forum Site 1.0 - Blind SQL Injection Exploit Title: Online Discussion Forum Site 1.0 - Blind SQL Injection Date: 2022-06-13 CVE: CVE-2022-31296 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2022-31295

CVE-2022-31295 Online Discussion Forum Site 1.0 - IDOR / Delete any post Exploit Title: Online Discussion Forum Site 1.0 - IDOR / Delete any post Date: 2022-06-13 CVE: CVE-2022-31295 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2022-31294

CVE-2022-31294 Online Discussion Forum Site 1.0 - Account Takeover Exploit Title: Online Discussion Forum Site 1.0 - CSRF Create New/Update Existing Admin User Account Takeover Date: 2022-06-13 CVE: CVE-2022-31294 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage:...

WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates ...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

EUVD-2026-56023

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553

CVE-2026-72553 describes a stored cross-site scripting flaw in ElkArte Forum 2.0 Beta 1. The issue allows any registered member to inject persistent JavaScript into profile fields cust_blurb and cust_locate, which are saved without HTML encoding and rendered unescaped in admin-visible profile vie...

PT-2026-70128

Name of the Vulnerable Software and Affected Versions ElkArte Forum version 2.0 Beta 1 Description A stored cross-site scripting issue allows registered members to inject persistent JavaScript into the cust blurb and cust locate profile fields. These fields are saved without HTML encoding and...