GHSA-4J38-RW27-97GX org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Impact It's possible to forge a request to delete a message. Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. Workarounds There's no easy workaround except upgrading. References https://jira.xwiki.org/browse/DISCUSSION-22 For more information If you have any...

TYPO3 wec_discussion extension SQL Injection Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. wecdiscussion extension is a third-party forum extension plugin used in it. A SQL injection vulnerability exists in TYPO3 wecdiscussion extension versions prior to 2.1.1. The...