FuseTalk categories.aspx FTVAR_SORTORDER Parameter XSS

The installed version of FuseTalk fails to sanitize user-supplied input to the 'FTVARSORTORDER' parameter in file 'categories.aspx' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into...

FuseTalk Detection

FuseTalk, a discussion forum software for ColdFusion or Microsoft .NET, is running on remote system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid48350; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

FuseTalk usersearchresults.cfm keyword Parameter XSS

The installed version of FuseTalk fails to sanitize user-supplied input to the 'keyword' parameter in file 'usersearchresults.cfm' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into ...

FuseTalk Forums 4.0 Cross Site Scripting

XSS vulnerability in FuseTalk Forums ------------------------------------- Vulnerability ID: Month Of Full Disclosure 1 = MOFD1 ------------------------------------ Product: FuseTalk ------------------------------------- Vendor: FuseTalk Inc...

FuseTalk 3.24.0 - Multiple Cross-Site Scripting Vulnerabilities

FuseTalk 3.24.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/42157/info FuseTalk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

FuseTalk 3.2/4.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/42157/info FuseTalk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Sql injection

SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVARSUBCAT txForumID parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm...

CVE-2007-3705

SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVARSUBCAT txForumID parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm...

CVE-2007-3705

CVE-2007-3705 affects FuseTalk 2.0, where a SQL injection flaw exists in the forum/index.cfm path. The vulnerability is triggered via the FTVAR_SUBCAT (txForumID) parameter and relates to forum/include/error/forumerror.cfm, allowing remote attackers to execute arbitrary SQL commands. The provided...

CVE-2007-3705

SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVARSUBCAT txForumID parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm...

FuseTalk Multiple XSS Vulnerabilities

Binary data 4111.prm...

FuseTalk txForumID Parameter SQL Injection

Binary data 4112.prm...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the 1 FTVARLINKP and 2 FTVARURLP parameters to a forum/include/error/autherror.cfm, and...

CVE-2007-3339

Multiple cross-site scripting XSS vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the 1 FTVARLINKP and 2 FTVARURLP parameters to a forum/include/error/autherror.cfm, and...

CVE-2007-3339

CVE-2007-3339 affects FuseTalk (Basic/Standard/Enterprise/ColdFusion). The issue resides in forum/include/error/autherror.cfm (and related comfinish.cfm) where input parameters FTVAR_LINKP, FTVAR_URLP, and FTVAR_SCRIPTRUN can be injected to produce cross-site scripting. Documents corroborate the ...

fusetalkautherror-xss.txt

Hello everyone, After trying to report a SQL bug autherror.cfm to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure...

FuseTalk Multiple Script XSS

The remote host is running FuseTalk, a discussion forum implemented in ColdFusion. The version of FuseTalk installed on the remote host fails to properly sanitize user-supplied input to several parameters and scripts before using it to generate dynamic content. An unauthenticated, remote attacker...

CVE-2007-3301

SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrary SQL commands via the errorcode parameter. NOTE: a patch may have been released privately between April and June 2007. NOTE: this issue may overlap CVE-2007-3273...

CVE-2007-3301

CVE-2007-3301 concerns FuseTalk (forum) 2.0, specifically a SQL injection vulnerability in the file forum/include/error/autherror.cfm exposed via the errorcode parameter. The entry notes that a patch may have been released privately between April and June 2007 and that this issue may overlap CVE-...

FuseTalk 4.0 - blogincludecommoncomfinish.cfm?FTVAR_SCRIPTRUN Cross-Site Scripting

FuseTalk 4.0 - blogincludecommoncomfinish.cfm?FTVARSCRIPTRUN Cross-Site Scripting source: https://www.securityfocus.com/bid/24563/info FuseTalk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can...