311 matches found
CVE-2021-43032
CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access to the admin panel can save cross-site scripting payloads in any function within the application that accepts HTML code. A payload placed within the 'Advertising' functionality will execute globally on the client side, allowing for...
CVE-2026-73312
CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...
CVE-2026-73321
CVE-2026-73321: PHP worker stack overflow through nested BBCode XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. Result The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nestin...
CVE-2026-73319
CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...
CVE-2026-73318
CVE-2026-73318: Missing authorization on force-agreement actions XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController...
CVE-2026-73317
CVE-2026-73317: Approval job authorization bypass XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user. What happens The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only...
CVE-2026-73316
CVE-2026-73316: PayPal webhook replay XenForo before 2.3.13 processes the same valid PayPal REST webhook more than once. What happens The PayPal REST provider overrides XenForo's base transaction validator but omits its duplicate transaction-log lookup. The database index is also non-unique. Two...
CVE-2026-73315
CVE-2026-73315: SSRF through PayPal certificate URL XenForo before 2.3.13 fetches the certificate URL supplied by a PayPal REST webhook without restricting its destination. What happens The callback handler passes PAYPAL-CERT-URL to XenForo's trusted HTTP reader. It does not require a PayPal...
CVE-2026-73314
CVE-2026-73314: Unsupported PayPal signature algorithm accepted XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm...
CVE-2026-73313
CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...
CVE-2026-74239
CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...
CVE-2026-73309
CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...
CVE-2026-73320
CVE-2026-73320: Unauthenticated unfurl result disclosure XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs. What happens unfurl.php accepts a POST containing global UnfurlResult IDs, loads those rows, and returns rendered...
CVE-2026-73310
CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...
CVE-2026-73311
CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...
Exploit for CVE-2026-74239
CVE-2026-74239 XenForo before 2.3.13 is vulnerable to path tr...
Exploit for CVE-2026-73321
CVE-2026-73321 XenForo before 2.3.13 can exhaust a PHP worker...
Exploit for CVE-2026-73320
CVE-2026-73320 XenForo before 2.3.13 exposes pending rich-lin...