CVE-2026-69091: Missing Authentication for Critical Function

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-32818: Missing Authorization

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topicdelete and postdelete actions in forum.php only validate the CSRF token but perfo...

EUVD-2010-2472

Malware in sbrugna...

EUVD-2015-1610

Malware in sbrugna...

EUVD-2007-5793

Malware in sbrugna...

EUVD-2007-0843

Malware in sbrugna...

EUVD-2007-2294

Malware in sbrugna...

EUVD-2009-3169

Malware in sbrugna...

EUVD-2005-2431

Malware in sbrugna...

EUVD-2005-0414

Malware in sbrugna...

CVE-2010-2463

Cross-site scripting XSS vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the postid parameter in a modify action...

Cross site scripting

Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1diyportalview.tpl.php does not restrict the content...

CVE-2018-10298

CVE-2018-10298 concerns Discuz! DiscuzX up to X3.4, where a reflected XSS is possible via forum.php?mod=post&action=newthread. The root cause is that data/template/1_diy_portal_view.tpl.php does not restrict user-submitted content, enabling injected scripts. This is documented across multiple fee...

CVE-2018-10298

Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1diyportalview.tpl.php does not restrict the content...

CVE-2018-10298: Improper Neutralization of Input During Web Page Generation

Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1diyportalview.tpl.php does not restrict the content...

WP Symposium Plugin for WordPress forum.php 'show' Parameter SQL Injection

The WordPress WP Symposium Plugin installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'show' parameter of the forum.php script. An unauthenticated, remote attacker can exploit this issue to inject or manipulate...

Sql injection

SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERYSTRING to the default URI...

CVE-2015-3325

CVE-2015-3325 affects the WordPress WP Symposium plugin, specifically the forum.php component. The vulnerability is a SQL injection via the show parameter in the QUERY_STRING, allowing an unauthenticated, remote attacker to manipulate or disclose data in the back-end database. The issue is tied t...

CVE-2015-3325: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERYSTRING to the default URI...

CVE-2015-1475

My Little Forum (versions 2.3.3, 2.2, and 1.7) contains multiple cross-site scripting (XSS) vulnerabilities. An attacker can inject arbitrary script/HTML via (1) page or (2) category parameters to forum.php, or (3) page or (4) order parameters to board_entry.php or forum_entry.php. Public details...