Data Breach Disclosed by Online Invitation Firm Evite

Online invitation and stationary company Evite has notified customers of a data breach that stemmed from an “inactive data storage file” associated with user accounts. The company over the weekend said that during April 2019, it became aware of a “security incident involving potential unauthorize...

MyBB Cross-Site Scripting Vulnerability (CNVD-2019-16947)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB version 1.8.19, which can be exploited by attacker...

InnoGames: Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)

The referrer leaked the CSRF code, when opening an embedded PHP file set by the images function in tribe forums. Due to a premium function, which allows players to store and run Javascript scripts during the game, the session ID could be grabbed, as it was mistakenly embedded into the DOM. This...

Hackers hacked: Account hijacking forum OGUsers pwned

By Uzair Amir The stolen OGUsers database is available on RaidForums for download. On 12th May, hackers managed to steal the database of a famous hijacker forum called OGUsers. This forum is used by hackers and online account hijackers, which means that the hackers have now been given a taste of...

Cross site request forgery (csrf)

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

CVE-2019-12253

CVE-2019-12253 affects the project’s “my little forum” prior to version 2.4.20. The vulnerability is a CSRF flaw that allows deleting posts via a crafted request (e.g., mode=posting&delete_posting). The issue is confirmed across multiple feeds (NVD/NVD-derived entries, Red Hat advisory, OSV, CVE ...

CVE-2019-12253

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&deleteposting...

Account Hijacking Forum OGusers Hacked

Ogusers.com -- a forum popular among people involved in hijacking online accounts and conducting SIM swapping attacks to seize control over victims' phone numbers -- has itself been hacked, exposing the email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum...

DRUPAL-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

Code execution vulnerability in HadSky Light Forum system (CNVD-2019-14572)

HadSky Light Forum System is a free and open forum system for individual users. A code execution vulnerability exists in the HadSky Light Forum System, which can be exploited by an attacker to gain control of the web server...

PHPWind Has Arbitrary File Deletion Vulnerability

PHPWind is a set of PHP-based Web forum program . PHPWind has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

Code Execution Vulnerability in HadSky Light Forum System

HadSky Light Forum System is a free and open forum system for individual users. A code execution vulnerability exists in the HadSky Light Forum System, which can be exploited by an attacker to gain control of the web server...

CVE-2018-19202

A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsettingbburl' parameter...

Vanilla: Stored XSS in Profile Comments

Summary: The Profile Comments page which is responsible for listing a profile's recent comments is vulnerable to stored XSS as it renders the contents of recent comments without sanitizing them. Steps to reproduce: 1. Ensure you are logged in to a user account no special permissions are needed 2...

Discuz Forum System MagaCMS Online Newspaper Reader Plugin has SQL Injection Vulnerability

Discuz! is an online forum system. A SQL injection vulnerability exists in the MagaCMS Online Newspaper Reader plugin for Discuz forum system, which can be exploited by attackers to obtain sensitive information from the database...

PHPWind Has Arbitrary Directory Deletion Vulnerability

PHPWind is a set of PHP-based Web forum program . PHPWind has an arbitrary directory deletion vulnerability that can be exploited by an attacker to delete arbitrary directories...

Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability

Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...