Reddit: Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`

Summary: It is possible for moderators to send messages to users from a banned subreddit. I assume this is not intended considering that when trying to send a message as a banned subreddit via reddit.com/message/compose from field you get a 200 response but the message is never delivered to the...

CVE-2021-39161

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scriptingXSS attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed...

CVE-2021-39161

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scriptingXSS attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed...

PT-2021-22418 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue allows category names to be used for Cross-site scripting XSS attacks. This is mitigated by Discourse's default Content Security Policy, and...

A Clubhouse Bug Let People Lurk in Rooms Invisibly

The vulnerabilities opened the door to “ghosts” hiding in and disrupting rooms, where moderators would be unable to mute them...

MyBB 1.8.25 - Poll Vote Count SQL Injection Vulnerability

Exploit Title: MyBB 1.8.25 - Poll Vote Count SQL Injection Exploit Author: SivertPL email protected Description: Lack of sanitization in the "votes" parameter in "Edit Poll" causes a second-order semi-blind SQL Injection that is triggered when performing a "Move/Copy" operation on the thread...

Hackers Flood Reddit With Pro-Trump Takeovers

By apparently compromising moderator accounts, the attackers were able to post MAGA materials all over at least 70 popular subreddits...

Information Disclosure

nodebb is vulnerable to information disclosure. The topics that have been deleted are hidden for moderators but not for an administrator...

MyBB Bans List 1.0 Cross Site Scripting

Exploit Title: MyBB Bans List - Cross Site Scripting Date: 7/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=423 Version: 1.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14724 1. Description: Adds bans.php page, showing a li...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...

GD bbPress 2.5 Cross Site Scripting

An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary javascript code via filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $errorafilea in...

GD bbPress Attachments <= 2.5 - Authenticated Stored XSS

An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary JavaScript code via the image filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $error‘file’ in...

Dimofinf 3.0.0 SQL Injection Vulnerability

Dimofinf version 3.0.0 cookie SQL injection exploit. Dimofinf CMS Automatic Cookie SQL Injection exploit Google Dork: intext:"Powered by Dimofinf" Date: 19/11/2015 Author: D35m0nd142 Software link: http://www.dimofinf.net Version: 3.0.0 Tested on: Dimofinf version 3.0.0 Sometimes it happens that...

"4chan Hacked", Most Popular Image-Bulletin Board Compromised

The founder of 4chan, Christopher Poole, aka “moot” has confirmed few hours ago, in a blog post that the popular image-based bulletin board was hacked. The attacker gained access to the administrative functions and successfully hacked into one of 4chan’s database by exploiting a website's softwar...

Underground Marketplace 'Utopia' Seized by Dutch Police, 5 suspects arrested

After Silk Road, another underground online marketplace 'Utopia' has been seized by Dutch National Police, where users could buy illegal drugs and guns for home delivery. The police started their investigation under Codename 'Operation Commodore' in 2013, and finally seized Utopia's Germany-based...

Elastix Voip system 2.x , Php code injection / Data dump Exploit

Elastix is famous asterisk voip system interface dist. it's vulnerable to php code injection vuln , which can be used to dump all data including - SIP Extention Data - Plain text admin password - Moderators passwords - All trunks data - shell upload Usage Info just add the ip list to "list.txt"...

Flynax General Classifieds v4.0 CMS Multiple Vulnerabilities

Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities Details: ======== 1.1 A SQL Injection vulnerability is detected in the Flynax General Classifieds v4.0 Content Management System. Remote attackers without privileged user accounts can execute/inject own sql commands to compromise the...

Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities

Document Title: =============== Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=659 Release Date: ============= 2012-07-12 Vulnerability Laboratory ID VL-ID:...

Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities

Document Title: =============== Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=659 Release Date: ============= 2012-07-12 Vulnerability Laboratory ID VL-ID:...

Seditio SF Quick Ban 1.0 Cross Site Request Forgery

================================================================ Vulnerable Software: SF - Quick Ban sfquickban version 1.0 is Plugin for Seditio CMS. http://www.seditioforge.com/plugins/administration/sf-quick-ban-i65.html http://www.seditioforge.com/page.php?id=65&a=dl MD5 SUM:...