285 matches found
phpBB Remote Code Execution
Passing an absolute path to a fileexists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions...
MyBB Admin Control Panel Remote Code Execution (CVE-2022-24734)
A code injection vulnerability exists in MyBB. The vulnerability is due to insufficient input validation when parsing user input sent to Admin Control Panel...
MyBB 代码注入漏洞
MyBB is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A remote code execution vulnerability exists in MyBB, which can be exploited to cause a Remote Code Execution RCE...
PT-2021-23436 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.28 Description: The issue allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. Recommendations: For versions prior to 1.8.28, update to version 1.8....
Design/Logic Flaw
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel which will require a physical reset to restore administrative control via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/setfactory URI...
CVE-2020-29194
CVE-2020-29194 affects Panasonic Security System WV-S2231L (firmware 4.25). A denial-of-service of the admin control panel is possible via a POST to /cgi-bin/set_factory with Randomnum=99AC8CEC6E845B28&mode=1, requiring a physical reset to regain control. Documented impact: admin control panel un...
phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel
Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50937)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP of vBulletin 5.6.3. The vulnerability can be exploited to conduct a cross-site scripting attack via the headings of the sub-help items in the "Login/Logout...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50938)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the admincp/search.php?do=dosearch URI...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50936)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Style Manager's Style Options Settin...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50940)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Smilie title of Smilies Manager...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50935)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Junior Member Title in the User Titl...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50939)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP of vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Pay to subscribe to email notifications" field in t...
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...
CVE-2020-25117
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager...
CVE-2020-25118
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...
CVE-2020-25120
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...