Flarum Cross-Site Request Forgery Vulnerability

Flarum is an open source forum system. A cross-site request forgery vulnerability exists in Flarum versions prior to 0.1.0-beta.9. The vulnerability stems from a networked system or product that does not adequately validate the origin or authenticity of data, which can be exploited by an attacker...

Cross-Site Request Forgery (CSRF)

flarum/core is vulnerable to cross-site request forgery CSRF. The application was not able to determine the authenticity and origin of requests received due to a lack of anti-CSRF tokens. This allows remote attackers to submit unwanted requests on behalf of users when the users are tricked into...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

Cross site request forgery (csrf)

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-13183

CVE-2019-13183 : Flarum before 0.1.0-beta.9 is vulnerable to cross-site request forgery (CSRF) on all POST endpoints, demonstrated by changing admin settings. The issue affects Flarum open-source forum software prior to the 0.1.0-beta.9 release; no explicit root-cause details beyond CSRF exposure...

Command injection

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

CVE-2019-11514

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

CVE-2019-11514

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

CVE-2019-11514

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

CVE-2019-11514

Summary (CVE-2019-11514): In Flarum core, the file User/Command/ConfirmEmailHandler.php mishandles invalidation of user email tokens prior to 0.1.0-beta.8. This creates insecure session management where email tokens can be reused, potentially enabling a remote attacker to gain access to a user ac...

SQL Injection Vulnerability in FlarumChina Frontend

FlarumChina is an open source Chinese version of Flarum forum software. A SQL injection vulnerability exists in FlarumChina version v0.1.0-beta.7C. A remote attacker can exploit this vulnerability by sending a request to execute SQL commands...

Insecure Direct Object Reference

flarum/core is vulnerable to insecure direct object reference. An attacker is able to exploit the vulnerability to modify user information which can possibly lead to a full account takeover...

CVE-2018-19133

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

CVE-2018-19133

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

Design/Logic Flaw

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

CVE-2018-19133

CVE-2018-19133 involves Flarum Core 0.1.0-beta.7.1, where a flaw leads to exposure of user email addresses (PII). The connected Red Hat/GHSA entries reinforce the same description of a privacy leak, but the provided documents do not specify the root cause details, affected code paths, or a remedi...

CVE-2018-19133

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...