MyBB < 1.8.21 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

WordPress: Mssing Authorization on Private Message replies (BuddyPress)

Description: Users can reply to private message threads which they are not participants of by changing the threadid parameter in the messagessendreply ajax action. This affects both the Legacy and Nouveau Template packs. Steps To Reproduce: 1. Login to your account 2. Send the following request...

WordPress: Stored XSS in Private Message component (BuddyPress)

Description: WordPress version: 5.0.3 BuddyPress version: 4.1.0 Users with accounts can send private messages containing rendered HTML to other uses, this includes being able to execute javascript code via elements such as scripts, iframe etc. The XSS is stored in the database and is triggered an...

Advanced Electron Forum Private Message Module Cross-Site Scripting Vulnerability

Advanced Electron Forum AEF is an online forum system written in PHP.Private Message is one of the personal information modules. A cross-site scripting vulnerability exists in the 'FTP Link' element of the Private Message module in AEF version 1.0.9, which originates from unfiltered content in th...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Cross site scripting

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Private Message PHP Script 2.0 - Persistent Cross-Site scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Private Message PHP Script 2.0 - Persistent Cross-Site scripting Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/private-message-php-script/21027192?srank=1 Version: 2.0 Tested on: Windows...

Discourse: Stored XSS in "post last edited" option

There are two users: Attacker and Victim. 2. Attacker starts a private talk via private message with the Victim. 3. Attacker send a message to Victim, then he edits it or deletes it. 4. Victim sees the yellow pencil, symbol of the edit. 5. Victim clicks on yellow pencil to see the edit and the...

b3log Symphony cross-site scripting vulnerability (CNVD-2017-38345)

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability to obtain a user cookie by...

Discourse: SSRF in upload IMG through URL

-Short description Private message function is vulnerable is vulnerable to a SSRF vulnerability which allows an attacker to craft connections originating from servers to any destination on the internet and discourse internal network and craft outgoing UDP-packet for example, to connect to FTP...

Signal Adds iPhone Access to Desktop App

Open Whisper Systems has long offered Android users of its encrypted messaging app a companion desktop version of the service. iPhone users haven’t been as lucky until Monday when the company announced desktop support for iPhone users of its Signal desktop beta app called Signal Private Messenger...

Invision Power Board 4.1.4.x - Persistent XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: IP.Board Persistent XSS Vulnerability Date: 29/10/2015 Software Link: https://www.invisionpower.com/buy Software version : 4.1.4.x Exploit Author: Mehdi Alouache Contact: email protected Category: webapps 1. Description Any...

Invision Power Board (IP.Board) 4.1.4.x - Persistent Cross-Site Scripting

Exploit Title: IP.Board Persistent XSS Vulnerability Date: 29/10/2015 Software Link: https://www.invisionpower.com/buy Software version : 4.1.4.x Exploit Author: Mehdi Alouache Contact: [email protected] Category: webapps 1. Description Any registered user can execute remote...

WordPress MDC Private Message Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL server set up a personal blog site . MDC Private Message is one of the plug-ins used to send private messages . A cross-site scripting vulnerability...

CVE-2015-6805

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...

Cross site scripting

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...

CVE-2015-6805

CVE-2015-6805 (MDC Private Message plugin 1.0.0 for WordPress) is an XSS vulnerability where remote authenticated users can inject arbitrary script/HTML via the private message field. Multiple sources (NVD, CVE lists, WPVulnDB) corroborate that the flaw affects the message input and can lead to s...

CVE-2015-6805

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...