CVE-2025-3387 renrenio renren-security JSON cross site scripting

A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

PT-2025-15306 · Renrenio · Renren-Security

Name of the Vulnerable Software and Affected Versions: renrenio renren-security versions up to 5.4.0 Description: A vulnerability has been found in renrenio renren-security, affecting an unknown part of the JSON Handler component. The manipulation leads to cross-site scripting attacks, which can ...

renren-security 代码注入漏洞

renren-security is a lightweight, front-end and back-end separated Java rapid development platform open source by renrenio. A code injection vulnerability exists in renren-security version 5.4.0 and earlier, which stems from cross-site scripting in JSON Handler...

YFCMF Remote Command Execution Vulnerability

YFCMF is Hunan Renren Technology Co., Ltd. developed a set of back-end content management framework based on ThinkPHP5.1. + foreign ACE1.40 UI template. A remote command execution vulnerability exists in YFCMF v2.3.1. An attacker can exploit this vulnerability by sending a constructed POST messag...

Command Execution Vulnerability in Renren CMS Backend

Renren CMS is a new core and open source free PHP enterprise website development and construction management system , is a set of PHP CMS source code , to meet the needs of various types of enterprise website development and construction . A command execution vulnerability exists in the backgroun...

Renren Video pc client software suffers from dll hijacking vulnerability

YYeTs started out as a non-professional subtitle group for foreign film and television programs for the purpose of sharing, exchanging and learning. Formerly known as YYeTs Subtitle Group, it was founded in 2003 by a Canadian-Chinese student, Little Ghost God, who formally set up an independent...

3g.renren.com XSS vulnerability

Open Bug Bounty ID: OBB-648618 Description| Value ---|--- Affected Website:| 3g.renren.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

widget.renren.com XSS vulnerability

Vulnerable URL:...

Renren Android client gesture lock vulnerability

Renren focuses on personal mortgage business and is committed to providing professional financial information services for individuals and small and medium-sized enterprises. A vulnerability in the gesture lock of Renren Caixuan's Android client allows an attacker to bypass a layer of...

Universal Design Vulnerability in Renren

Renren is a large-scale learning Internet resource sharing platform. A design vulnerability exists in the user login area of this website system. Because user login does not require authentication, an attacker can exploit the vulnerability to break the login password and obtain sensitive system...

Renren permanent control of others by all accounts a method-vulnerability warning-the black bar safety net

Through all the client click on the access personal home page, you can let the users sync log on to the PC the browser end The login process is substantially as follows, parameters have been removed, interest Go directly to the capture see: the 1. http://gadget.talk.renren.com/redirects 2...

Renren seven years activities of the lottery machine can break through the limit of infinite shake-vulnerability warning-the black bar safety net

http://seven.renren.com/websitecelebrate There is a lottery machine, shake it out, the results did not, suggesting that the next rocker to be in the next one hour. ! http://s.xnimg.cn/a49632/actimg/12anniversary/js/anniversary.js Found so a JS file that contains the 7 anniversary of the page the...

CVE-2012-0915

Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image...

CVE-2012-0916

Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file...

Heap overflow

Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file...

Integer overflow

Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image...

CVE-2012-0916

CVE-2012-0916 affects RenRen Talk 2.9. The vulnerability is a heap-based buffer overflow in

CVE-2012-0916

Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file...

CVE-2012-0915

Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image...

CVE-2012-0915

Summary: CVE-2012-0915 concerns RenRen Talk 2.9, where an integer signedness error in skin-file handling enables a remote attacker to trigger a heap-based buffer overflow via a crafted BMP image. The fault is in how dimensions of a skin file are processed, leading to arbitrary code execution as d...