CVE-2019-9889: Improper Limitation of a Pathname to a Restricted Directory

In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of...

Vanilla Forums 2.x Open Redirection

Exploit Title : VanillaForums 2.x Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 11/03/2019 Vendor Homepage : open.vanillaforums.com Software Information Link : vanillaforums.com/en/software/ open.vanillaforums.com/addon/vanilla-core Software...

Cross site scripting

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

CVE-2019-8279

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

CVE-2019-8279

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

CVE-2019-8279

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

CVE-2019-8279

CVE-2019-8279 is a vulnerability in Vanilla Forums prior to 2.5 identified as multiple stored XSS in forum messages. The underlying issue is that arbitrary JavaScript could be injected into messages, enabling remote attackers to execute code in a user’s browser. The connected documents confirm th...

PT-2019-18962

Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.5 Description The issue allows remote attackers to inject arbitrary JavaScript code into any message on the forum via multiple stored XSS. Recommendations For versions prior to 2.5, update to version 2.5 or...

CVE-2019-8279: Improper Neutralization of Input During Web Page Generation

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum...

Vanilla Forums Stored Cross-Site Footer Vulnerability

Vanilla Forums is a Canadian company Vanilla Forums PHP-based open source forum program . A stored cross-site script vulnerability exists in Vanilla Forums. An attacker can exploit this vulnerability to gain access to the backend administrator...

Vanilla: Stored XSS in vanilla

Summary: There is a stored XSS in the latest version 2.8 of vanilla. Attack with post privileges can trigger this. Description: In last report 481360, I found a XSS cause by Format. But in lastest version 2.8, the default Format of Discussion and Comment is Rich. In this Format, we can insert a...

Vanilla: Stored XSS in vanilla

Summary: There is a stored XSS in the latest version 2.6.4 of vanilla. Attack with post privileges can trigger this. Description: This is a feature that user can post content in markdown format. And the content and format type is inserted into database without check the format param. So attack ca...

Vanilla Remote Code Execution Vulnerability (CNVD-2019-06793)

Vanilla is an open source multi-language, fully extensible forum program. A security vulnerability exists in Vanilla versions prior to 2.5.5 and 2.6.x prior to 2.6.2. A remote attacker can exploit this vulnerability to execute code by calling the 'unserialize' function...

Design/Logic Flaw

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

CVE-2018-19499

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

CVE-2018-19499

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

CVE-2018-19499

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

CVE-2018-19499

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

CVE-2018-19499

The CVE-2018-19499 issue affects Vanilla Forums (Vanilla) where the unserialize vulnerability is in the Gdn_Format class. A crafted phar-archive can trigger remote code execution, requiring authentication (which can be bypassed according to the advisory) and allowing code execution under the web ...

PT-2018-14976

Name of the Vulnerable Software and Affected Versions Vanilla versions prior to 2.5.5 Vanilla versions 2.6.x prior to 2.6.2 Description The issue allows for Remote Code Execution. This is because authenticated administrators have access to a reachable call to unserialize in the Gdn Format class...