Codoforum 5.1 - Arbitrary File Upload

Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain...

CodoForum-v5.1---Remote-Code-Execution-RCE-

CodoForum v5.1 - Authenticated RCE Fixed Exploit CVE: 20...

CVE-2022-31854

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel...

CVE-2020-7051

Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...

EUVD-2020-28184

Malware in sbrugna...

EUVD-2020-18511

Malware in sbrugna...

EUVD-2020-18507

Malware in sbrugna...

EUVD-2020-18508

Malware in sbrugna...

EUVD-2020-26997

Malware in sbrugna...

EUVD-2020-26996

Malware in sbrugna...

EUVD-2020-28185

Malware in sbrugna...

EUVD-2020-29838

Malware in sbrugna...

EUVD-2020-14611

Malware in sbrugna...

EUVD-2020-26491

Malware in sbrugna...

EUVD-2020-26492

Malware in sbrugna...

CVE-2020-5843

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen...

CVE-2020-22540

Stored Cross-Site Scripting XSS vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component...

CVE-2020-9007

Codoforum 4.8.8 allows self-XSS via the title of a new topic...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-5842

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page...