XenForo 2.1.10 Patch 2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: XenForo v2.1.10 Patch 2 Stored XSS Author: Vincent666 ibn Winnie Software Link: https://xenforo.com/demo/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog :https://pentest-vincent.blogspot.com/ PoC...

XenForo 2.1.10 Patch 2 Cross Site Scripting

Exploit Title: XenForo v2.1.10 Patch 2 Stored XSS Date:16.08.2020 Author: Vincent666 ibn Winnie Software Link: https://xenforo.com/demo/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog :https://pentest-vincent.blogspot.com/ PoC...

Razer: [IDOR] API endpoint leaking sensitive user information

Summary: Hi, the backend on the insider.razer.com website seems to be using XenForo. Some actions on the api.php have been left misconfigured by the developers, which lead to leaking of sensitive information. Steps To Reproduce: 1. Go to a random user's profile, say,...

XenForo 1.5.x Advanced Application Forms 1.2.2 Open Redirection

Exploit Title : XenForo 1.5.x Advanced Application Forms 1.2.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 02/03/2019 Vendor Homepage : xenforo.com snogssite.com Software Information Link :...

XenForo 1.5.x Open Redirection

Exploit Title : XenForo 1.5.x XF-Russia Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 02/03/2019 Vendor Homepage : xf-russia.ru Software Information Link : xf-russia.ru/xenforo/changelog.html xf-russia.ru/xenforo/russian-language.html...

Vanilla: Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution Vulnerability

Summary: An authenticated admin user can inject an unserializable password in a another users account. Later when attempting a login with that user, the attacker can trigger a call to an unserialize in the splitHash function. By using a custom pop chain to write into the constants.php file, an...

XenForo 2 CSS Loader Denial Of Service

Exploit Title: XenForo CSS Loader DoS Google Dork: intext:"Forum software by XenForoaC/" inurl:css.php ext:php Date: 22-03-18 Exploit Author: LockedByte Vendor Homepage: https://xenforo.com/ Software Link: https://xenforo.com/help/installation/ Version: XenForo 2 Tested on: Linux...

XenForo 2 - CSS Loader Denial of Service

XenForo 2 - CSS Loader Denial of Service Exploit Title: XenForo CSS Loader DoS Google Dork: intext:"Forum software by XenForo™" inurl:css.php ext:php Date: 22-03-18 Exploit Author: LockedByte Vendor Homepage: https://xenforo.com/ Software Link: https://xenforo.com/help/installation/ Version:...

XenForo 2 - CSS Loader Denial of Service

Exploit Title: XenForo CSS Loader DoS Google Dork: intext:"Forum software by XenForo™" inurl:css.php ext:php Date: 22-03-18 Exploit Author: LockedByte Vendor Homepage: https://xenforo.com/ Software Link: https://xenforo.com/help/installation/ Version: XenForo 2 Tested on: Linux...

XenForo 2 - CSS Loader Denial of Service Exploit

Exploit for php platform in category web applications Exploit Title: XenForo CSS Loader DoS Google Dork: intext:"Forum software by XenForo™" inurl:css.php ext:php Exploit Author: LockedByte Vendor Homepage: https://xenforo.com/ Software Link: https://xenforo.com/help/installation/ Version: XenFor...

wunderkessel.de XSS vulnerability

Open Bug Bounty ID: OBB-549813 Description| Value ---|--- Affected Website:| wunderkessel.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Forum software by XenForo Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Xenforo Forum CMS 1.5.13 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications +---------------------------------------------------------+ | Vulnerable Software: Xenforo Forum CMS | | Vendor: http://xenforo.com | | Vulnerability Type: Persistent XSS authenticated | | Date Released: 07/04/2017 | | Released by: MLT |...

Xenforo Forum CMS 1.5.13 Cross Site Scripting

| \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | | | |...

XenForo Remote Code Execution Vulnerability

XenForo is a community forum software with a fresh interface and a powerful engine. A remote code execution vulnerability exists in XenForo versions between 1.5.x and 1.5.11a, which can be exploited by an attacker to execute arbitrary code by constructing a specific HTTP request...

XenForo 1.5.x Remote Code Execution Vulnerability

Exploit for php platform in category web applications XenForo 1.5.x Remote Code Execution Vulnerability 1. ADVISORY INFORMATION ======================= Product: XenForo Vendor URL: xenforo.com Type: Code Injection CWE-94 Date found: 2016-12-09 Date published: 2016-12-15 CVSSv3 Score: 9.3...

XenForo ToggleME 3.1.2 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenForo ToggleME plugin Vendor URL: https://xenforo.com/community/resources/toggleme.137/ Type: Cross-Site Scripting CWE-79 Date found: 2016-09-06 Date published: 2016-09-11 CVSSv3 Score: 5....

XenAPI For XenForo 1.4.1 SQL Injection

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

XenAPI 1.4.1 for XenForo - Multiple SQL Injections RCESEC-2016-002 XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

RCESEC-2016-002 XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Da...