On the 20th Safer Internet Day, what was security like back in 2004?

Today is the 20th Safer Internet Day. Since 2004, there's been an annual event designed to "Promote safer and more responsible use of online technology and mobile phones, especially amongst children and young people across the world." 2004 was a key year for several safety activities, encompassin...

xss bypass the sanitize

Description hi,@maintainer.The filter you use to clean xss is unsafe.Please choose an xss filter with a large number of users and a high evaluation Proof of Concept 1.Login to the forum as any user. 2.Send dangerous messages to admin users. 3.The value of the Message is below click me 4.Admin use...

xss bypass the filter

Description hi,@maintainer.The filter you use to clean xss is unsafe.Please choose an xss filter with a large number of users and a high evaluation Video link You can watch my video through this link first. link https://drive.google.com/file/d/1mh9hiDxmybLQGPw-z36qBdsEcEOoPw8/view?usp=sharelink...

U.S. No Fly List Leaked on Hacker Forum

By Waqas The leak includes the full names and dates of birth of 1.8 million individuals on the No-Fly List with suspected or known ties to terrorist organizations. This is a post from HackRead.com Read the original post: U.S. No Fly List Leaked on Hacker Forum...

XSS caused by sending information between users

Description The forum allows users to send information. Although the script tag cannot be used, the img tag can also cause xss.And the program can bypass the filtering of the "cookie" string by means of entity encoding. Video link You can watch my video through this link first. link...

Yandex Source Code Online Leaked, Company Denies Hack

By Waqas The threat actor has dumped a whopping 44.7 GB worth of Yandex data, including its source code repository, on a popular hacker forum. This is a post from HackRead.com Read the original post: Yandex Source Code Online Leaked, Company Denies Hack...

Design/Logic Flaw

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum this is caused by a lack of checks performed by the /forums.php?action=post page...

CVE-2022-46890

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum this is caused by a lack of checks performed by the /forums.php?action=post page...

CVE-2022-46890

CVE-2022-46890 affects NexusPHP prior to 1.7.33. The issue is a weak access control on the forums.php?action=post endpoint, allowing a remote authenticated user to edit any forum post due to missing checks. Impact is limited to the documented behavior; no exploitation details are provided beyond ...

kavkaz-forum.com Cross Site Scripting vulnerability OBB-3157682

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-22488

Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the...

Design/Logic Flaw

Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the...

CVE-2023-22488

CVE-2023-22488 affects Flarum core notification logic. The vulnerability stems from the notification-sending flow not validating that the notification subject is visible to the recipient, enabling reading of restricted/private content via subscriptions. Impact includes leakage of posts (including...

CVE-2023-22487

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @""p syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post...

Design/Logic Flaw

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @""p syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post...

CVE-2023-22487

Concrete details show that Flarum, via the flarum/mentions extension, leaks the full JSON:API payload of all mentioned posts in certain API responses (POST /api/posts, PATCH /api/posts/) regardless of access rights. Affected are all Flarum versions prior to 1.6.3; mitigation is to upgrade to flar...

GHSA-22M9-M3WW-53H3 Flarum post mentions can be used to read any post on the forum without access control

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @""p syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into...

forum-aviation.com Cross Site Scripting vulnerability OBB-3138737

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

XSS via markdown syntax

Description Hi,Maintainer,thanks for reading.I am glad to report a secure problem to you. I found that your forum allows users to use markdown syntax to post articles and comments, but there is no corresponding protection means, which is unsafe. Any user can post dangerous content, like the...

Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum

By Waqas The data was collected through web scraping techniques however some sites are reporting it as a "Twitter data breach," or " Twitter being hacked." This is a post from HackRead.com Read the original post: Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum...