7174 matches found
CVE-2009-5068
There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...
CVE-2009-5068
The CVE concerns Simple Machines Forum (SMF) up to version 2.0.3. In some deployments, co-admins with access to the same SMF instance can read arbitrary files, including settings.php containing database passwords, enabling privilege escalation. No specific exploit details or mitigations are provi...
CVE-2005-4891
Simple Machine Forum SMF versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements...
File Upload Vulnerability in Light Forum System of Roving Cloud
Cruise Cloud Light Forum System is an open source web application based on JAVA + MYSQL architecture, including forums, Q&A modules. Patrol Cloud Light Forum System has a file upload vulnerability that can be exploited by an attacker to upload malicious files and gain access to the site...
Directory Traversal Vulnerability in Cruising Cloud Light Forum System
Cruise Cloud Light Forum System is an open source web application based on JAVA + MYSQL architecture, including forums, Q&A modules. Patrol Cloud Light Forum system has a directory traversal vulnerability that can be exploited by an attacker to view the server file system structure and file conte...
Arbitrary File Download Vulnerability in Cruise Cloud Light Forum System
Cruise Cloud Light Forum System is an open source web application based on JAVA + MYSQL architecture, including forums, Q&A modules. Patrol Cloud Light Forum system has an arbitrary file download vulnerability, attackers can use this vulnerability to download arbitrary files to obtain sensitive...
CVE-2020-5306
Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content...
MyBB Open Redirect Vulnerability
MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A security vulnerability exists in MyBB versions prior to 1.8.22. The vulnerability can be exploited t...
CISO Forum 2019: Vulnerability Management, Red Teaming and a career in Information Security abroad
Today, at the very end of 2019, I want to write about the event I attended in April. Sorry for the delay . This doesn't mean that CISO Forum 2019 was not Interesting or I had nothing to share. Not at all! In fact, it was the most inspiring event of the year, and I wanted to make a truly monumenta...
WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability
CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...
Xiuno BBS code issue vulnerability
Xiuno BBS is an open source forum program based on PHP and MySQL. A code issue vulnerability exists in Xiuno BBS version 4.0. The vulnerability stems from an improperly designed or implemented problem in the code development process of a web system or product. No detailed vulnerability details ar...
bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS
Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. The payload below will result in a stored XSS in the 'Style Customize' page. " /...
Mail.ru: HTML injection at face.city-mobil.ru
Browser-specific IE HTML injection in city-mobil.ru On the moment of reporting, HTML injection within this scope was considered under same condition with XSS. Under current rules, HTML injection without proven XSS execution may be not eligible for bounty. https://rdot.org/forum/showthread.php?t=2...
Hundreds of counterfeit online shoe stores injected with credit card skimmer
There's a well-worn saying in security: "If it's too good to be true, then it probably isn't." This can easily be applied to the myriad of online stores that sell counterfeit goods—and now attract secondary fraud in the form of a credit card skimmer. Allured by great deals on brand names, many...
HadSky has an XSS vulnerability
HadSky Light Forum is a newborn original PHP MySQL open source system , the main goal is to achieve light , fast , simple , full , 100% original open source system . HadSky XSS vulnerability , attackers can exploit the vulnerability to obtain administrator cookie information...
MyBB UserCP Cross-Site Scripting Vulnerability
MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB UserCP. This vulnerability allows attackers to...
File upload vulnerability in MyUPB ad***_ic***.php file
MyUPB is a database-free forum that uses text files to store data. A file upload vulnerability exists in the MyUPB adic.php file. This allows an attacker to upload a webshell and gain server privileges...
forum.javisintlmedia.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1023112 Security Researcher Gh05tPT Helped patch 6901 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting forum.javisintlmedia.com...
