CVE-2026-111912

Admidio versions 5.0.0 before 5.0.16 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the ForumService::saveTopic() function. This vulnerability allows authenticated members to modify forum topics belonging to other users by replacing the topic_uuid parameter in a topic_sa...

CVE-2026-111912 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

CVE-2026-111912 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

EUVD-2026-103308

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

CVE-2026-111912: Authorization Bypass Through User-Controlled Key

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

CVE-2026-63171

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute...

CVE-2026-63171 Omnispace Agora Project < 26.10.0 Stored XSS via Category Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute...

CVE-2026-63171: Improper Neutralization of Input During Web Page Generation

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute...

CVE-2026-39779

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

EUVD-2026-95731

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-39779 WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-39779

The Asgaros Forum WordPress plugin (versions 3.4.0 and below ) is vulnerable to a Missing Authorization (CWE-862) flaw. This issue allows for the exploitation of incorrectly configured access control security levels . While the specific component or function is not identified, the vulnerability r...

WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by buitu in WordPress Plugin Asgaros Forum versions = 3.4.0...

EUVD-2026-95305

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

PT-2026-108874

Name of the Vulnerable Software and Affected Versions Asgaros Forum versions prior to 3.4.0 Description Asgaros Forum contains a missing authorization flaw that allows the exploitation of incorrectly configured access control security levels. Recommendations Update Asgaros Forum to version 3.4.0 ...

CVE-2026-39779: Missing Authorization

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-107799

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107799 Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107799

Jivejdon through version 5.0 contains a stored cross-site scripting (XSS) vulnerability. The flaw exists because the application renders unsanitized forum message bodies via messageListBody.jsp when using filter="false" and non-escaping default filters. This allows authenticated attackers to inje...

CVE-2026-107799

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...