SQLite report about CVE-2023-7104

This is a bug in the session extension of SQLite, not in the SQLite core. This bug is only reachable by applications that recompile SQLite using the -DSQLITEENABLESESSION compile-time option and then use the Session C-language APIs to process a changeset that has been subtly corrupted by an...

InfraGard infiltrated by cybercriminal

InfraGard, a partnership between the FBI and members of the private sector that was established to protect critical infrastructure in the US, has been infiltrated by a cybercriminal. As a result, its database of contact information is now for sale on an English-language cybercrime forum. InfraGar...

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

InfraGard, a program run by the U.S. Federal Bureau of Investigation FBI to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime foru...

forum.file-extensions.org Cross Site Scripting vulnerability OBB-3096498

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-46164

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised ...

Code injection

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised ...

CVE-2022-46164

NodeBB vulnerability CVE-2022-46164 arises from using a plain object with a prototype in socket.io message handling, enabling impersonation and account takeover. Affected software: NodeBB (Node.js-based forum software) prior to version 2.6.1. Root cause: prototype pollution in message handling al...

CVE-2022-46164 Account takeover via prototype vulnerability

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised ...

CVE-2022-46164 Account takeover via prototype vulnerability

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised ...

CVE-2022-4027

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible...

Cross site scripting

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible...

CVE-2022-42099

KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input...

Cross site scripting

KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input...

Simple:Press < 6.8.1 - Unauthenticated Stored XSS via Forum Replies

The plugin does not sanitise and escape the postitem parameter when posting a forum reply, which could allow unauthenticated users to perform Stored XSS attacks...

KLiK SocialMediaWebsite 跨站脚本漏洞

KLiK SocialMediaWebsite is a simple PHP-based social media website by the individual developer Muhammad Saad. A security vulnerability exists in KLiK SocialMediaWebsite version 1.0.1, which stems from the presence of XSS, allowing an attacker to store XSS via Forum Subject input...

PT-2022-26250 · Unknown · Klik Socialmediawebsite

Name of the Vulnerable Software and Affected Versions: KLiK SocialMediaWebsite version 1.0.1 Description: The issue allows attackers to store XSS via the location Forum Subject input, potentially affecting user security. Recommendations: For KLiK SocialMediaWebsite version 1.0.1, consider...

CVE-2022-42099

KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input...

CVE-2022-42099

KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input...

CVE-2022-42099

KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input...

CVE-2022-42099

The CVE-2022-42099 entry concerns KLiK SocialMediaWebsite version 1.0.1 with stored XSS via the Forum Subject input. The root cause is an XSS vulnerability in the forum subject handling that allows injected script to be stored and later executed by other users. Impact is described as enabling sto...