Simple Forum PHP 2.4 Cross Site Scripting

===================================================== Simple Forum PHP 2.4 - Reflected XSS ===================================================== Vendor Homepage: http://simpleforumphp.com Date: 14 Oct 2016 Demo Link : http://simpleforumphp.com/forum/admin.php Version : 2.4 Platform : WebApp - PHP...

Simple Forum PHP 2.4 - SQL Injection

Simple Forum PHP 2.4 - SQL Injection ===================================================== Simple Forum PHP 2.4 - SQL Injection ===================================================== Vendor Homepage: http://simpleforumphp.com Date: 14 Oct 2016 Demo Link : http://simpleforumphp.com/forum/admin.php...

Simple Forum PHP 2.4 SQL Injection

===================================================== Simple Forum PHP 2.4 - SQL Injection ===================================================== Vendor Homepage: http://simpleforumphp.com Date: 14 Oct 2016 Demo Link : http://simpleforumphp.com/forum/admin.php Version : 2.4 Platform : WebApp - PHP...

Simple Forum PHP 2.4 - Cross-Site Request Forgery (Edit Options)

document.forms0.submit;...

own-free-website.com XSS vulnerability

Vulnerable URL: http://www.own-free-website.com/forum/search.php?mode=results Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 85163 VIP website status:| No Check own-free-website.co...

Yahoo Challenged on Claims Breach Was State-Sponsored Attack

As challenges mount against Yahoo’s attribution of a massive 2014 data breach to state-sponsored hackers, CISO Bob Lord yesterday confirmed that a cache of 200 million Yahoo accounts marketed this summer in an underground forum is unrelated to the breach. Speaking at the Structure Security...

Mozilla Wants to Drop WoSign as Trusted CA

Mozilla has accused a Chinese Certificate Authority of back-dating SHA-1 certificates to get around restrictions barring deprecated certs from being trusted, and is ready to ban the CA for one year. The back-dating is just one of many violations derived after a lengthy investigation of WoSign and...

On the Yahoo Breach, the Security of IoT Forum

Mike Mimoso and Chris Brook discuss the news of the week, including the massive Yahoo breach, this week’s Security of Things Forum, Mamba ransomware, and the privacy implications of Google Allo. Download: ThreatpostNewsWrapSeptember232016.mp3 Music by Chris Gonsalves...

MyBB SQL Injection Vulnerability (CNVD-2016-08094)

MyBB is based on PHP MySQL build , powerful , efficient open source forum system . MyBB SQL injection vulnerability , allowing attackers to exploit the vulnerability to obtain sensitive database information...

MyBB 1.8.6 - SQL Injection

MyBB 1.8.6 - SQL Injection Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes...

Discuz x3.2 Remote Command Execution Vulnerability

Discuz! is a Web forum program. A remote command execution vulnerability exists in Discuz x3.2. Allows an attacker to construct special exploit code to remotely execute commands to gain server privileges...

bzol.vip XSS vulnerability

Vulnerable URL: http://bzol.vip/index.php?m=forum";...

Shopify: Deleted Post and Administrative Function Access in eCommerce Forum

Hi, I initially queried the following report as a comment in 165048, in which @juanbroullon confirmed the issue appeared valid and requested I open a new Shopify report. A selection of privileged information is provided upon appending /edit to a user profile URL on the eCommerce forum as an...

entrance-exam.net XSS vulnerability

Vulnerable URL: http://entrance-exam.net/forum/register.php?add=member Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 14566 VIP website status:| Yes Check entrance-exam.net SSL...

On Shadowbrokers, Cisco, Sweet32, Wildfire, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest on ShadowBrokers and Cisco, the Sweet32 collision attack, decryptors for the Wildfire ransomware, and this week’s gaming forum breaches. Download: ThreatpostNewsWrapAugust262016.mp3 Music by Chris Gonsalves...

GTA Fan Forum Hacked: Old vBulletin Software To Blame

Outdated vBulletin forum software is being blamed for the breach of a Grand Theft Auto fan forum called GTAGaming. It marks the second time in two days a gaming forum has been targeted by hackers and that a SQL injection vulnerability is believed to have been exploited. The fan website notified...

Epic Games Forums Hacked, 800,000 User Accounts Exposed

Epic Games is warning users of a breach that impacts 800,000 user accounts tied to the company’s online forums. On Monday, the game developer temporarily shut down many of its forums and advised users to change passwords on any accounts that shared the same credentials for some of its forums. Epi...

Epic Games Forum Hacked, Once Again — Over 800,000 Gamers' Data Stolen

If you are a fan of Unreal Tournament from Epic Games or ever have participated in discussions on the online forums run by Epic Games, you possibly need to change your forum password as soon as possible. It seems the Unreal Engine and its creators, Epic Games' forums have recently been compromise...

destination-canada-forum-emploi.ca XSS vulnerability

Vulnerable URL: http://www.destination-canada-forum-emploi.ca/accueil.php?lang=en" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 861968 VIP website status:| No Check...

QuickerBB 0.7.0 Cross Site Scripting

Document Title: =============== QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1895 Release Date: ============= 2016-08-11 Vulnerability Laboratory ID VL-ID:...