MyBB < 1.8.21 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

CVE-2019-12830: Improper Neutralization of Input During Web Page Generation

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

PT-2019-12972

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.21 Description The issue is related to a parsing flaw in the Private Message / Post renderer, specifically a nested video MyCode issue, which can lead to persistent XSS. This allows an attacker to potentially take ov...

WordPress: Mssing Authorization on Private Message replies (BuddyPress)

Description: Users can reply to private message threads which they are not participants of by changing the threadid parameter in the messagessendreply ajax action. This affects both the Legacy and Nouveau Template packs. Steps To Reproduce: 1. Login to your account 2. Send the following request...

WordPress: Stored XSS in Private Message component (BuddyPress)

Description: WordPress version: 5.0.3 BuddyPress version: 4.1.0 Users with accounts can send private messages containing rendered HTML to other uses, this includes being able to execute javascript code via elements such as scripts, iframe etc. The XSS is stored in the database and is triggered an...

Advanced Electron Forum Private Message Module Cross-Site Scripting Vulnerability

Advanced Electron Forum AEF is an online forum system written in PHP.Private Message is one of the personal information modules. A cross-site scripting vulnerability exists in the 'FTP Link' element of the Private Message module in AEF version 1.0.9, which originates from unfiltered content in th...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

Cross site scripting

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2018-13000: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

PT-2018-11529

Name of the Vulnerable Software and Affected Versions Advanced Electron Forum version 1.0.9 Description A persistent XSS issue is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content, enabling...

Private Message PHP Script 2.0 - Persistent Cross-Site scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Private Message PHP Script 2.0 - Persistent Cross-Site scripting Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/private-message-php-script/21027192?srank=1 Version: 2.0 Tested on: Windows...

Discourse: Stored XSS in "post last edited" option

There are two users: Attacker and Victim. 2. Attacker starts a private talk via private message with the Victim. 3. Attacker send a message to Victim, then he edits it or deletes it. 4. Victim sees the yellow pencil, symbol of the edit. 5. Victim clicks on yellow pencil to see the edit and the...

b3log Symphony cross-site scripting vulnerability (CNVD-2017-38345)

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability to obtain a user cookie by...

PT-2017-6669

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.x through 5.1.6 Description The issue allows remote authenticated users to bypass authorization checks and inject private messages into conversations. This is due to an input validation failure. Recommendations For version...

Discourse: SSRF in upload IMG through URL

-Short description Private message function is vulnerable is vulnerable to a SSRF vulnerability which allows an attacker to craft connections originating from servers to any destination on the internet and discourse internal network and craft outgoing UDP-packet for example, to connect to FTP...

Signal Adds iPhone Access to Desktop App

Open Whisper Systems has long offered Android users of its encrypted messaging app a companion desktop version of the service. iPhone users haven’t been as lucky until Monday when the company announced desktop support for iPhone users of its Signal desktop beta app called Signal Private Messenger...

Invision Power Board 4.1.4.x - Persistent XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: IP.Board Persistent XSS Vulnerability Date: 29/10/2015 Software Link: https://www.invisionpower.com/buy Software version : 4.1.4.x Exploit Author: Mehdi Alouache Contact: email protected Category: webapps 1. Description Any...