91 matches found
Unspecified Vulnerability in Smartstore SmartStoreNET
Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in SmartstoreNET version 4.1.1. The vulnerability stems from the...
Hardcoded credentials
An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...
CVE-2021-32608
An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...
CVE-2021-32608
CVE-2021-32608 affects SmartStoreNET up to version 4.1.1. The root cause is that Views/Boards/Partials/_ForumPost.cshtml renders user-controlled forum post text (FormattedText) without persistent sanitization, enabling a sanitize-then-transform issue. The vulnerability is demonstrated via Cross-S...
CVE-2021-32608
An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...
PT-2021-19805 · Unknown · Smartstore
Name of the Vulnerable Software and Affected Versions: Smartstore aka SmartStoreNET versions through 4.1.1 Description: An issue was discovered where the Views/Boards/Partials/ ForumPost.cshtml file does not call HtmlUtils.SanitizeHtml on certain text for a forum post, potentially leading to issu...
Mail.ru: Stored XSS In mlbootcamp.ru
XSS in mlbootcamp.ru via forum post...
CVE-2020-5306
Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content...
Arbitrary File Upload Vulnerability in Guojiz
Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload any type of image, such as a php Trojan horse, when editing a forum post or adding a comment via the upload image...
Vanilla: Stored XSS in Profile Comments
Summary: The Profile Comments page which is responsible for listing a profile's recent comments is vulnerable to stored XSS as it renders the contents of recent comments without sanitizing them. Steps to reproduce: 1. Ensure you are logged in to a user account no special permissions are needed 2...
CVE-2018-1135
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...
CVE-2018-1135
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...
Code injection
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...
Discuz! DiscuzX cross-site scripting vulnerability (CNVD-2018-08776)
Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4 and previous versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of forum.php?mod=post&action=newthread...
Moodle 3.0.x < 3.0.8 Multiple Vulnerabilities
Binary data 9922.prm...
Moodle 2.7.x < 2.7.18 Multiple Vulnerabilities
Binary data 9921.prm...
MyBB 1.8.6 - Cross-Site Scripting
Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 01/29/2016 Disclosed...
MyBB 1.8.6 Cross Site Scripting
Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 01/29/2016 Disclosed...
Moodle Cross-Site Request Forgery Vulnerability (CNVD-2016-03326)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site request forgery vulnerability exists in Moodle. An attacker could exploit...
The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.
The vulnerability of the mod/forum/post.php function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions through group-based authenticatio...