CVE-2022-43708

MyBB 1.8.31 has a issue 2 of 2 cross-site scripting XSS vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name...

Cross site scripting

MyBB 1.8.31 has a issue 2 of 2 cross-site scripting XSS vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name...

PT-2022-27014 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.31 Description: The issue allows attackers to inject HTML by persuading the user to upload a file with a specially crafted name, exploiting cross-site scripting XSS vulnerabilities in the post Attachments interface...

CVE-2022-43708

CVE-2022-43708 affects MyBB 1.8.31. The issue is a cross-site scripting vulnerability in the post Attachments interface that lets an attacker inject HTML by tricking a user into uploading a file with a specially crafted name. Root cause noted as insufficient input filtering/escaping for attachmen...

phpBB Cross-Site Request Forgery (CSRF)

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...

phpBB Cross-Site Request Forgery Vulnerability (CNVD-2020-19555)

phpBB is a set of open source and PHP-based Web forum software . The software has support for multiple languages , multiple databases and customized layout and so on. A cross-site request forgery vulnerability exists in phpBB 3.2.7, which can be exploited by attackers to delete post attachments...

CVE-2019-16107

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...

CVE-2019-16107

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...

Cross site request forgery (csrf)

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...

CVE-2019-16107

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...

DEBIAN-CVE-2018-12895

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...