CVE-2017-8898

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

Cross site scripting

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

CVE-2017-8898

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

CVE-2017-8899

CVE-2017-8899 affects Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier. The issue is a composite of Stored XSS and Information Disclosure in the attachments feature within User CP. The primary cause is the ability to upload an SVG document with a crafted attribute such as onload...

OLX: stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked

Hello, The OLX.PL is vulnerable to stored XSS attack. When adding new advertisement, it is possible to put a payload in its title here I used Titlealert1 I see ads are being pre-moderated, however it can remain uncaught also the length limit in title field is enough to insert into it e.g. a BeEF...

Security Alert: WordPress Forum plug-in bbPress, there is stored XSS vulnerability, the impact of fix version 2. 5. 9 all previous versions-bug warning-the black bar safety net

Recently, the WordPress parent company Automattic released bbPress 2.5.9 version in the official WordPress Forum plugin to the latest version, fixes a higher threat of the storage typeXSSvulnerabilities that affect the scope include existing bbPress version, i.e., version 2.5.9 of all will suffer...

Oxwall Forum v1.8.1 - Persistent Cross Site Vulnerability

Document Title: =============== Oxwall Forum v1.8.1 - Persistent Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1740 Release Date: ============= 2016-02-22 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2014-9438

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

CVE-2014-9438

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

CVE-2014-9438

CVE-2014-9438 is a CSRF vulnerability in the vBulletin 4.2.2 Moderator Control Panel. The issue allows an attacker to hijack an administrator’s session to perform actions such as banning/unbanning users, modifying user profiles, and approving or editing posts/topics via the modcp interface (e.g.,...

PT-2015-4201

Name of the Vulnerable Software and Affected Versions vBulletin version 4.2.2 Description A cross-site request forgery CSRF issue exists in the Moderator Control Panel, allowing remote attackers to hijack administrator authentication for various actions, including banning or unbanning a user via...

CVE-2014-9438: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerability

Exploit for php platform in category web applications This is private exploit. You can buy it at https://0day.today...

vBulletin Moderator Control Panel 4.2.2 CSRF

Exploit Title: vBulletin Moderator Control Panel CSRF Google Dork: "Powered by vBulletin® Version 4.2.2" Date: 16-12-2014 Exploit Author: Tomescu Daniel http://daniel-tomescu.com https://rstforums.com/forum Vendor Homepage: http://www.vbulletin.com/en/vb4-features/ Software Link: Premium Version:...

ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities

No description provided by source. Title: ====== ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Date: ===== 2012-11-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=689 VL-ID: ===== 689 Common Vulnerability Scoring System: ====================================...

Xnova Legacies 2009.2 CSRF Vulnerability

No description provided by source. Exploit Title: Xnova Legacies 2009.2 CSRF Date: 27/1/2011 Author: @xploitaday Software Homepage: http://www.xnova-ng.org/ Software Link: http://downloads.tuxfamily.org/xnlegacies/releases/xnova-legacies2009.2.tar.gz Version: 2009.2 Vuln file: admin/paneladmina.p...

OpenBB 1.0 Unauthorized Moderator Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4823/info OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. OpenBB is reported to be vulnerable to a condition that will allow an...

Woltlab Burning Board 2.x ModCP.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14617/info Woltlab Burning Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

Invision Power Board 1.x Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13802/info Invision Power Board is affected by an unauthorized access vulnerability. Reportedly, a moderator can edit forum posts owned by other moderators through an HTTP GET request without providing sufficient...