CVE-2019-13972

LayerBB 1.1.3 allows XSS via the application/commands/new.php pmtitle variable, a related issue to CVE-2019-17997...

CVE-2019-13973

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

CVE-2019-13972

LayerBB 1.1.3 allows XSS via the application/commands/new.php pmtitle variable, a related issue to CVE-2019-17997...

CVE-2019-13973

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

CVE-2019-13974

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

Default credentials

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

Sql injection

LayerBB 1.1.3 allows XSS via the application/commands/new.php pmtitle variable, a related issue to CVE-2019-17997...

Cross site request forgery (csrf)

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

CVE-2019-13974

CVE-2019-13974 affects LayerBB 1.1.3 and is a Cross‑Site Request Forgery in conversations.php/cmd/new. The vulnerability stems from insufficient validation of requests from trusted users. CVSS metrics indicate CVSSv3 base score 8.8 (HIGH) with network attack vector, low complexity, no privileges ...

CVE-2019-13974

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

CVE-2019-13973

CVE-2019-13973 affects LayerBB 1.1.3, where the admin/general.php arbitrary file upload is possible because the custom_logo filename suffix is not restricted, allowing a ".php" file. The vulnerability stems from insufficient validation of uploaded logo names, enabling potential remote code execut...

CVE-2019-13973

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

CVE-2019-13972

LayerBB 1.1.3 contains an XSS vulnerability in the pm_title parameter of application/commands/new.php (CVE-2019-13972). The issue is caused by insufficient input validation, enabling cross-site scripting and potentially exposing client-side data. This CVE is related to CVE-2019-17997. Publicly pr...

CVE-2019-13972

LayerBB 1.1.3 allows XSS via the application/commands/new.php pmtitle variable, a related issue to CVE-2019-17997...

PT-2019-13501

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3 Description The issue allows for XSS via the pm title variable in the application/commands/new.php file. Recommendations For LayerBB version 1.1.3, consider restricting the use of the pm title variable in the...

CVE-2019-13973: Unrestricted Upload of File with Dangerous Type

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

PT-2019-13502

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3 Description The issue allows for arbitrary file upload in the admin/general.php file due to the lack of restriction on the custom logo filename suffix, enabling the use of .php suffixes. Recommendations For LayerBB versio...

CVE-2019-13972: Improper Neutralization of Input During Web Page Generation

LayerBB 1.1.3 allows XSS via the application/commands/new.php pmtitle variable, a related issue to CVE-2019-17997...

CVE-2019-13974: Cross-Site Request Forgery (CSRF)

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

PT-2019-13503

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3 Description The issue allows for CSRF in conversations.php/cmd/new. Recommendations For LayerBB version 1.1.3, consider implementing CSRF protection measures, such as token-based validation, to prevent unauthorized reques...