CVE-2026-102373

GestSup versions before 3.2.62 are vulnerable to a private ticket comment disclosure flaw due to a failure to validate ticket ownership when loading comments via the threadedit parameter in thread.php . Authenticated attackers can exploit this by enumerating sequential comment IDs to read private...

EUVD-2026-88597

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

EUVD-2007-1509

Malware in sbrugna...

EUVD-2005-3742

Malware in sbrugna...

CVE-2025-50938: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php...

CVE-2020-8894: Undefined Security Weakness

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

AlkalinePHP <= 0.80.00 beta (thread.php id) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Portal : AlkalinePHP = Ver 0.80.00 beta Script Download: https://sourceforge.net/projects/alkalinephp/ exploit aported password crypted maybe is crypted with mysql exploit tatjibe password mcrypté :d mgharba :d:d:d:d Founded & Exploited by :...

CVE-2013-5983

Multiple cross-site scripting XSS vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the 1 "an" parameter to agenda.php or 2 cat parameter to mobile/thread.php...

CVE-2013-5983: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the 1 "an" parameter to agenda.php or 2 cat parameter to mobile/thread.php...

CVE-2009-4783

The CVE-2009-4783 item concerns multiple SQL injection vulnerabilities in Theeta CMS (version unclear). The affected entry points are the start parameter in three PHP scripts: community/forum.php, community/thread.php, and blog/index.php, where user-supplied input may be concatenated into SQL que...

CVE-2009-4783: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to execute arbitrary SQL commands via the start parameter to 1 forum.php and 2 thread.php in community/, and 3 blog/index.php...

CVE-2009-4782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to inject arbitrary web script or HTML via the 1 start, 2 forum, and 3 cat parameters to community/thread.php; 4 start and 5 cat parameters to community/forum.php; and 6 start parameter to...

PHPWind 6.0 multiple cross-site scripting vulnerability-vulnerability warning-the black bar safety net

PHPWind is a domestic of the more popular PHP-based Web forum application. PHPWind 在 访客 注销 时 没有 正确 的 过滤 提交 给 hack.php and search.php and read.php and post.php and thread.php and profile.php and sort.php and message.php and userpay. php, etc. page of request parameters, a remote attacker can submi...

PHPWind 6.0 Cross Site Scripting

I found the PHPWind v6.0 just filter the xss code when the visitors login in, but it doesnt do it when login off. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This flaw makes its all the parameters...

CVE-2008-5726

SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-5726

CVE-2008-5726 describes an SQL injection in stormBoards 1.0.1's thread.php that lets remote attackers execute arbitrary SQL commands via the id parameter. Affected software: stormBoards 1.0.1; vulnerable component: thread.php. Root cause: unsafely concatenated SQL queries exposed to user-supplied...

CVE-2008-5726: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

StormBoard 1.0.1 (thread.php id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ StormBoard 1.0.1 thread.php id SQL Injection Vulnerability ============================================================...

Unfixed XSS vulnerability at www.xoxohth.com

Security researcher Mystick, has submitted on 11/11/2008 a cross-site-scripting XSS vulnerability affecting www.xoxohth.com, which at the time of submission ranked 194585 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/02/2009. It is current...

CVE-2008-2395: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...