Simple Machines Forum 2.0.3 Path Disclosure

Summary: -------------- A security flaw allows an attacker to know the full path of the web system. Details: ----------- SSI.php Line 294: // Fetch a post with a particular ID. By default will only show if you have permission to the see the board in question - this can be overriden. function...

CVE-2012-5903

Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php...

CVE-2012-5903

Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php...

Smf 2.0.2 Cross-Site Scripting Vulnerability

a bug in Smf 2.0.2 that allows to us to occur a Cross-Site Scripting on a Remote machin. Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum/ Software Link : http://www.simplemachines.org Security Risk : High Version : A...

SMF 2.0.2 Local File Inclusion

Exploit Title : SMF v2.0.2 Local File Include Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.simplemachines.org/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : intext:"SMF 2.0.2 |...

Simple Machines 2.0.2 - Multiple HTML Injection Vulnerabilities

Simple Machines 2.0.2 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54456/info Simple Machines is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content...

Simple Machines Forum (SMF) 1.1.15 - fckeditor Arbitrary File Upload

Simple Machines Forum SMF 1.1.15 - fckeditor Arbitrary File Upload source: https://www.securityfocus.com/bid/50925/info Simple Machines Forum is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload...

Simple Machines Forum (SMF) 1.1.15 - 'fckeditor' Arbitrary File Upload

source: https://www.securityfocus.com/bid/50925/info Simple Machines Forum is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in...

CVE-2011-4173

Cross-site request forgery CSRF vulnerability in Simple Machines Forum SMF 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtaine...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Simple Machines Forum SMF 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtaine...

CVE-2011-4173

The data confirms CVE-2011-4173 is a CSRF vulnerability in Simple Machines Forum (SMF) 2.x prior to 2.0.1, enabling remote attackers to hijack administrator/moderator sessions via image-file related vectors. Affected product/component: SMF 2.x (before 2.0.1); root cause is a cross-site request fo...

CVE-2011-3615

Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...

Sql injection

Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...

CVE-2011-3615

Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...

CVE-2011-3615

CVE-2011-3615 affects Simple Machines Forum (SMF). Remote attackers can exploit multiple SQL injection vulnerabilities via two vectors: (1) HTML entity handling and (2) display name processing. Affected software includes SMF versions before 1.1.15 and 2.x before 2.0.1. The underlying issue allows...

Simple Machines Forum (SMF) 2.0 Session Hijacking Vulnerability

Simple Machines Forum SMF is prone to session hijacking vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Simple Machines Forum (SMF) 1.1.14/2.0 - '[img]' BBCode Tag Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/49311/info Simple Machines Forum is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks ar...

Simple Machine Forum v1.1.10 - Multiple Web Vulnerabilities

Document Title: =============== Simple Machine Forum v1.1.10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=118 Release Date: ============= 2011-07-20 Vulnerability Laboratory ID VL-ID: ====================================...

Simple Machines Forum <= 2.0 RC4 Sesc theft (XSRF)

Exploit for php platform in category web applications Exploit Title: Simple Machines Forum 0day.today 2018-01-01...

CVE-2011-1131

The PlushSearch2 function in Search.php in Simple Machines Forum SMF before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created,...