CVE-2021-40509

ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature...

JForum Cross-Site Scripting Vulnerabilities

JForum is a web-based open source forum system developed by Jforum team using Java language. A cross-site scripting vulnerability exists in JForum, which stems from the failure of the product's ViewCommon.java file to properly handle user input data. An attacker can use this vulnerability to...

jforum 2.7.0 Cross Site Scripting

hi, I found a vulnerability in the jforum 2.7.0. It is a storage cross site script vulnerability. The place is the user's profile - signature. The technique of the vulnerability is the same as that described in this article "STORED CROSS SITE SCRIPTING IN BBCODE"...

CVE-2019-7550

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

CVE-2019-7550

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

Cross site request forgery (csrf)

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

CVE-2019-7550

CVE-2019-7550 concerns JForum 2.1.8, where an unauthenticated remote attacker can enumerate existing users by invoking the create user flow via a register/check/username?username= request. A positive match yields an “is already in use” error, indicating user existence. This is an information-disc...

CVE-2019-7550

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

PT-2019-18641

Name of the Vulnerable Software and Affected Versions JForum version 2.1.8 Description The issue allows an unauthenticated, remote attacker to determine whether a specific user exists by utilizing the "create user" function. This is achieved by sending a register/check/username?username= request...

CVE-2019-7550: Generation of Error Message Containing Sensitive Information

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

JForum 2.1.8 bookmarks CSRF & XSS

No description provided by source. JForum 2.1.8 bookmarks CSRF & XSS Advisory Information Advisory ID: NGENUITY-2010-004 Date published: 2010-06-06 Vulnerability Information Class: Cross-Site Request Forgery CSRF Software Description Per jforum.net JForum is a powerful and robust discussion board...

JForum Detection

Binary data jforumdetect.nbin...

JForum jforum.page start Parameter XSS

The version of JForum installed on the remote host fails to properly sanitize user-supplied input to the 'start' parameter of the 'jforum.page' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security contex...

CVE-2013-7209

Cross-site request forgery CSRF vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action...

CVE-2013-7209

Cross-site request forgery CSRF vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action...

CVE-2013-7209

The CVE-2013-7209 entry concerns JForum (Java-based forum) with a CSRF flaw in the Admin module, specifically admBase/login.page. The vulnerability affects the adminUsers/group permissions flow via the groupsSave action, enabling an attacker to hijack an administrator’s session and cause arbitrar...

JForum login.page adminUsers模块iyonghu权限跨站请求伪造漏洞

CVE ID:CVE-2013-7209 JForum是采用Java开发的功能强大且稳定的论坛系统。 JForum login.page中的adminUsers模块不正确保护跨站请求伪造攻击，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 JForum 目前没有详细解决方案提供： http://jforum.net/...

CVE-2013-7209: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action...

PT-2013-6295

Name of the Vulnerable Software and Affected Versions JForum affected versions not specified Description A cross-site request forgery CSRF issue exists in the Admin module of JForum, specifically in the admBase/login.page. This allows remote attackers to hijack the authentication of administrator...