CVE-2021-45252

Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability...

PT-2021-24209 · Unknown · Simple Forum-Discussion System

Name of the Vulnerable Software and Affected Versions: Simple Forum-Discussion System version 1.0 Description: The issue affects the Simple Forum-Discussion System, allowing an attacker to retrieve all information from the database. This is possible due to multiple SQL injection vulnerabilities...

Simple Forum-Discussion System SQL注入漏洞

Simple Forum-Discussion System is a simple forum/discussion system. SQL injection vulnerability exists in Simple Forum-Discussion System, which originates in various components such as manage topic.php, manage user.php and ajax.php. Lack of validation of externally entered SQL statements. An...

Exploit for Expression Language Injection in Apache Log4J

Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 Attack...

Simple Forum-Discussion System 1.0 SQL Injection Vulnerability

Simple Forum-Discussion System 1.0 Vendor Description: Multiple SQL-Injections are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system...

CVE-2021-24827

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue...

PT-2021-16314

Name of the Vulnerable Software and Affected Versions: Asgaros Forum WordPress plugin versions prior to 1.15.13 Description: The issue arises from the lack of validation and escaping of user input when subscribing to a topic, which is then used in a SQL statement. This leads to an unauthenticated...

CVE-2021-24827: Improper Neutralization of Special Elements used in an SQL Command

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue...

Phoswap Token gas has a logic flaw vulnerability

Vulnerability mining supported by the Ministry of Science and Technology National Key R&D Program Topic 2020YFB1005802 The token contract freeze function will gradually increase its gas consumption when it is called multiple times, and when the gas consumption is extremely large, the running cost...

CVE-2021-22953

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"...

CVE-2021-22953

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"...

Cross site request forgery (csrf)

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"...

CVE-2021-22953

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"...

PT-2021-10335

Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A reflected cross-site scripting XSS issue in the "/weibo/topic" API endpoint allows attackers to execute arbitrary web scripts or HTML. This could potentially lead to unauthorized actions on behalf of the...

CVE-2020-19295: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

Design/Logic Flaw

In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked...

Cross-Site Request Forgery (CSRF) in namelessmc/nameless

✍️ Description csrf bug to stick a topic 🕵️‍♂️ Proof of Concept Bellow url is vulnerable to csrf attack to stick a topic . http://localhost/nameless/index.php?route=/forum/stick/&tid=1 💥 Impact csrf bug to stick a topic...

Cross-Site Request Forgery (CSRF) in namelessmc/nameless

✍️ Description csrf bug to lock a topic 🕵️‍♂️ Proof of Concept i see everywhere is csrf token checking . But in this case csrf token checking is missing .\ Bellow url is vulnerable to csrf attack to lock a topic . http://localhost/nameless/index.php?route=/forum/lock/&tid=1 💥 Impact csrf bug to...

CVE-2021-37703

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform that includes community, email and chat room features. The platform includes community, email, and chat room features.Discourse suffers from an information disclosure vulnerability that stems from not adding a valid configuration to the...