XenForo 2.2.15 Cross Site Request Forgery

------------------------------------------------------------------------------- XenForo = 2.2.15 Widget::actionSave Cross-Site Request Forgery Vulnerability ------------------------------------------------------------------------------- - Software Link: https://xenforo.com - Affected Versions:...

Xenforo 2.2.15 Remote Code Execution Vulnerability

XenForo versions 2.2.15 and below suffer from a remote code execution vulnerability in the Template system. ----------------------------------------------------------------------- XenForo = 2.2.15 Template System Remote Code Execution Vulnerability...

CVE-2024-38457

Xenforo before 2.2.16 allows CSRF...

CVE-2024-38458

Xenforo before 2.2.16 allows code injection...

CVE-2024-38457

Xenforo before 2.2.16 allows CSRF...

CVE-2024-38458

Xenforo before 2.2.16 allows code injection...

PT-2024-28014 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows code injection. Recommendations: For versions prior to 2.2.16, update to version 2.2.16 or later to resolve the issue...

PT-2024-28013 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For versions prior to 2.2.16, update to version...

CVE-2024-38457

Xenforo before 2.2.16 allows CSRF...

XenForo Cross-Site Request Forgery Vulnerability

XenForo is open source commercial Internet forum software package written in the PHP programming language. A security vulnerability exists in XenForo versions prior to 2.2.16. An attacker exploited the vulnerability to perform a cross-site request forgery attack...

XenForo Security Vulnerability

XenForo is an open source commercial Internet forum software package written in the PHP programming language. A security vulnerability exists in XenForo versions prior to 2.2.16 that stems from allowing code injection...

CVE-2024-38458

Xenforo before 2.2.16 allows code injection...

CVE-2024-38458

Summary: CVE-2024-38458 affects XenForo, with versions prior to 2.2.16 vulnerable via the Template system, enabling code execution. The 1337DAY/PacketStorm entries describe a remote-code-execution path in XenForo

CVE-2024-38458

Xenforo before 2.2.16 allows code injection...

CVE-2024-38457

CVE-2024-38457 affects XenForo software prior to 2.2.16. The vulnerability is a Cross-Site Request Forgery (CSRF) in the Widget::actionSave flow, where XenForo does not check GET vs POST before saving a widget. Anti-CSRF checks are applied only to POST requests, enabling CSRF attacks that can cre...

CVE-2024-38457

Xenforo before 2.2.16 allows CSRF...

CVE-2024-25006

XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...

CVE-2024-25006

XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...

Directory traversal

XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...

XenForo Security Vulnerability

XenForo is open source commercial Internet forum software package written in the PHP programming language. A security vulnerability exists in XenForo versions prior to 2.2.14. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...