CVE-2023-6835

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated...

CVE-2023-6835

WSO2 API Manager is identified as vulnerable due to lack of server-side input validation in the Forum feature, which could allow manipulation of API ratings. The issue is documented across multiple sources (including CVE-2023-6835 and related advisories) with no explicit exploit details provided ...

PT-2023-32784 · Wso2 · Wso2

Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: The issue is related to a lack of server-side input validation in the Forum feature, which could allow API rating manipulation. Recommendations: At the moment, there is no information...

Ten Years Later, New Clues in the Target Breach

On Dec. 18, 2013, KrebsOnSecurity broke the news that U.S. retail giant Target was battling a wide-ranging computer intrusion that compromised more than 40 million customer payment cards over the previous month. The malware used in the Target breach included the text string "Rescator," which also...

forum-thyroide.net Cross Site Scripting vulnerability OBB-3802397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

e-flight-forum.com Improper Access Control vulnerability OBB-3798856

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-47870

Cross-Site Request Forgery CSRF, Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF, Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6...

CVE-2023-47870

CVE-2023-47870 describes a CSRF/Missing Authorization flaw in wpForo Forum (WordPress plugin) versions up to 2.2.6, enabling CSRF and ACL-constraint bypass that can force logout of all users. Multiple sources identify wpForo as the affected product and indicate exploitation is not detailed in the...

CVE-2023-47872

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3...

CVE-2023-47872

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3...

CVE-2023-47872 WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team wpForo Forum allows Stored XSS.This issue affects wpForo Forum: from n/a through 2.2.3...

CVE-2023-47872

CVE-2023-47872 - wpForo Forum (WordPress plugin) Affected: wpForo Forum plugin for WordPress, versions up to and including 2.2.3.Root cause: Improper Neutralization of Input During Web Page Generation, resulting in a Stored Cross-Site Scripting (XSS) vulnerability. The issue permits stored XSS wi...

WordPress Plugin wpForo Forum Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Plugin wpForo Forum Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-30651 · Unknown · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum versions 2.2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions...

PT-2023-30650 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum versions through 2.2.6 Description: The issue is related to Cross-Site Request Forgery CSRF and Missing Authorization, allowing unauthorized access to functionality not properly constrained by Access Control Lists ACLs. This can...

wpForo Forum < 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVE-2023-5604

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress super-administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files e.g. .php, .phtml, potentially leading to remote code execution...