CVE-2019-16108

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets CSS token sequence to a page through BBCode...

CVE-2019-16108

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets CSS token sequence to a page through BBCode...

CVE-2019-16108

Summary (CVE-2019-16108): phpBB 3.2.7 is vulnerable to CSS injection via BBCode that can inject an arbitrary CSS token sequence into a page. The root cause is insecure handling/validation of BBCode parameters, enabling an attacker to alter page styling. The vulnerability affects phpBB 3.2.7; no e...

CVE-2019-16108

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets CSS token sequence to a page through BBCode...

CVE-2019-16108: Improper Control of Generation of Code

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets CSS token sequence to a page through BBCode...

Mail.ru: Stored XSS in Review Section https://games.mail.ru/

Stored XSS via malcrafted link bbcode in review editor...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Cross site request forgery (csrf)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Session Token In URL

PhpBB sends the session token via a GET parameter in the URL. Due to the way phpbb works, having the session ID is not enough for a remote attacker to gain access to the application since the session tokens are tied to an IP address. However, with knowledge of the administrator's session ID, the...

CVE-2019-16993: Cross-Site Request Forgery (CSRF)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Exploit for Cross-site Scripting in Kunena

CVE-2019-15120 Exploit for XSS via BBCode on Kunena extension...

CVE-2019-15120

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode...

CVE-2019-15120

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode...

Cross site scripting

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode...

CVE-2019-15120

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode...

CVE-2019-15120

The CVE covers Kunena (Joomla! extension) prior to version 5.1.14. The issue is a stored XSS via BBCode in Kunena messages which is exploitable by normal user input in any BBCode-enabled field. Exploit documentation notes that this XSS can lead to remote code execution. Affected product/version: ...

PT-2019-13999 · Joomla · Kunena

Name of the Vulnerable Software and Affected Versions: Kunena extension versions prior to 5.1.14 for Joomla! Description: The issue allows for XSS via BBCode, which can be exploited to execute malicious scripts. Recommendations: For versions prior to 5.1.14, update to version 5.1.14 or later to...

CVE-2019-15120: Improper Neutralization of Input During Web Page Generation

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode...

Design/Logic Flaw

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...