Gnuboard5 5.3.2.8 - SQL Injection

Exploit Title: Gnuboard5 5.3.2.8 - SQL Injection Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/gnuboard/gnuboard5 Software Link: https://github.com/gnuboard/gnuboard5 Version: 5.3.2.8 Tested on: Ubuntu Windows CVE : CVE-2020-18662 PoC: 1 POST /install/installdb.p...

GNUBOARD5 访问控制错误漏洞

GNUBOARD5 is a web forum system based on PHP and MySQL. A security vulnerability exists in GNUBOARD5 versions 5.5.4 and 5.5.5, which stems from the presence of insecure privileges and can be exploited by an attacker to change all users' passwords without knowing the victim's original password...

CVE-2022-3963

A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fmid leads to cross site scripting. It is possible to launch the attack remotely. Upgrading ...

Cross site scripting

A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fmid leads to cross site scripting. It is possible to launch the attack remotely. Upgrading ...

CVE-2022-3963 gnuboard5 FAQ Key ID faq.php cross site scripting

A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fmid leads to cross site scripting. It is possible to launch the attack remotely. Upgrading ...

CVE-2022-3963 gnuboard5 FAQ Key ID faq.php cross site scripting

A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fmid leads to cross site scripting. It is possible to launch the attack remotely. Upgrading ...

CVE-2022-3963

CVE-2022-3963 affects gnuboard5, targeting the FAQ Key ID Handler in file bbs/faq.php. The issue is a cross-site scripting (XSS) vulnerability caused by manipulating the fm_id parameter, enabling remote exploitation. A fix is available in version 5.5.8.2.1, with patch identifier ba062ca5b62809106...

CVE-2022-3963 gnuboard5 FAQ Key ID faq.php cross site scripting

A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fmid leads to cross site scripting. It is possible to launch the attack remotely. Upgrading ...

CVE-2022-1252

Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any...

CVE-2022-1252 Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5

Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any...

CVE-2022-1252 Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5

Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any...

GNUBOARD5 加密问题漏洞

GNUBOARD5 is a PHP and MySQL based web forum system. GNUBOARD5 5.5.5 and prior versions suffer from a cryptographic issue vulnerability that stems from the application's use of weak encryption algorithms resulting in the exposure of password information. An unauthorized attacker could exploit thi...

Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5

Description https://github.com/gnuboard/gnuboard5/blob/v5.4.22/mobile/shop/lg/mispwapurl.phpL7 has no filtering for the variable. So, Attackers can trigger Reflected XSS via $GET'LGDOID' Proof of Concept /mobile/shop/lg/mispwapurl.php?LGDOID=%3Cscript%3Ealert1%3C/script%3E Impact Attacker can...

CVE-2021-3831

gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3831

gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3831 Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5

gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3831

CVE-2021-3831 affects Gnuboard 5. A cross-site scripting vulnerability exists in Gnuboard 5 via the $_GET['LGD_OID'] parameter, indicating improper input handling in the web page generation path. The Nuclei template specifies the affected component as Gnuboard 5 and identifies the vulnerability a...

Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5

Description The reflected XSS vulnerability occurs to a flaw in the cleanxsstags function called in memo.php of Gnuboard 5. This cleanxsstags is a Sanitizer that removes XSS-vulnerable tags and attributes. However, it can bypass Sanitizer by using a newline character. %0A, %0D, ETC Proof of Conce...

Open Redirect in gnuboard/gnuboard5

Description php ?php includeonce'./common.php'; $g5'title' = "로그인 검사"; $mbid = isset$POST'mbid' ? trim$POST'mbid' : ''; $mbpassword = isset$POST'mbpassword' ? trim$POST'mbpassword' : ''; runevent'memberlogincheckbefore', $mbid; if !$mbid || !$mbpassword alert'회원아이디나 비밀번호가 공백이면 안됩니다.'; $mb =...

GNUBOARD5 Cross-Site Scripting Vulnerability (CNVD-2021-45752)

GNUBOARD5 is a Web forum system based on PHP and MySQL. A cross-site scripting vulnerability exists in GNUBOARD5 5.3.2.8 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the url parameter in bbs/login.php...