100 matches found
CVE-2018-17997
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
CVE-2018-17996
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
CVE-2018-17997
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
CVE-2018-17996
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
Cross site request forgery (csrf)
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
Design/Logic Flaw
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
CVE-2018-17997
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
CVE-2018-17997
LayerBB 1.1.1 contains a Cross‑Site Scripting (XSS) vulnerability in the titles of conversations (PMs). The underlying issue is improper handling of input in conversation titles, enabling an attacker to inject scripts that may execute in a victim’s browser. Reports across multiple sources (NVD/Re...
CVE-2018-17997
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
CVE-2018-17996
CVE-2018-17996 affects LayerBB versions up to 1.1.2; CSRF allows adding an admin user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/. Root cause is CSRF vulnerability; vulnerable until 1.1.2, fixed in 1.1.3. References include ...
CVE-2018-17996
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
CVE-2018-17996
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
PT-2019-9541
Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.1 Description The issue allows for XSS via the titles of conversations, specifically private messages PMs. Recommendations For LayerBB version 1.1.1, consider restricting the ability to set conversation titles until a fix i...
PT-2019-9540
Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.3 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to perform unauthorized actions such as adding a user via "admin/new user.php", deleting a user via...
CVE-2018-17996: Cross-Site Request Forgery (CSRF)
LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...
CVE-2018-17997: Improper Neutralization of Input During Web Page Generation
LayerBB 1.1.1 allows XSS via the titles of conversations PMs...
LayerBB SQL Injection Vulnerability
LayerBB is a small set of forum software. A SQL injection vulnerability exists in LayerBB version 1.1.1. A remote attacker can exploit this vulnerability by sending the 'searchquery' parameter to the search.php file to execute SQL commands...
CVE-2018-17988
LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php searchquery parameter...