CVE-2018-19499: Deserialization of Untrusted Data

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the GdnFormat class...

Remote code execution

Vanilla 2.6.x before 2.6.4 allows remote code execution...

CVE-2018-18903

Vanilla 2.6.x before 2.6.4 allows remote code execution...

CVE-2018-18903

Vanilla 2.6.x before 2.6.4 allows remote code execution...

CVE-2018-18903

Vanilla 2.6.x before 2.6.4 allows remote code execution...

CVE-2018-18903

Vanilla 2.6.x before 2.6.4 allows remote code execution...

CVE-2018-18903

The CVE-2018-18903 issue affects Vanilla Forums (Vanilla) in the domGetImages function of the ImportController, where unserialize via a crafted phar archive enables remote code execution without authentication. This is tied to Vanilla Forums prior to 2.6.4. Affected product: Vanilla Forums; vulne...

PT-2018-14715

Name of the Vulnerable Software and Affected Versions Vanilla versions 2.6.x before 2.6.4 Description The issue allows remote code execution. Recommendations For versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue...

CVE-2018-18903: Improper Control of Generation of Code

Vanilla 2.6.x before 2.6.4 allows remote code execution...

Vanilla Cross-Site Scripting Vulnerability

Vanilla is an open source multi-language, fully extensible forum program. A cross-site scripting vulnerability exists in Vanilla versions prior to 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the email field in the basic information...

Cross site scripting

Vanilla before 2.6.1 allows XSS via the email field of a profile...

CVE-2018-17571

Vanilla before 2.6.1 allows XSS via the email field of a profile...

CVE-2018-17571

Vanilla before 2.6.1 allows XSS via the email field of a profile...

CVE-2018-17571

Vanilla before 2.6.1 allows XSS via the email field of a profile...

CVE-2018-17571

CVE-2018-17571 affects Vanilla before 2.6.1. The vulnerability is a cross-site scripting (XSS) flaw reachable via the email field in a user profile. The connected CNVD/NVD/OSV entries consistently describe the same issue and identify Vanilla 2.6.1 as the fixed version. Practical impact, per the s...

PT-2018-14063

Name of the Vulnerable Software and Affected Versions Vanilla versions prior to 2.6.1 Description The issue allows for cross-site scripting XSS attacks via the email field of a user's profile. This occurs when an attacker injects malicious code into the email field, which is then executed by the...

CVE-2018-17571: Improper Neutralization of Input During Web Page Generation

Vanilla before 2.6.1 allows XSS via the email field of a profile...

Vanilla: Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution Vulnerability

Summary: An authenticated admin user can trigger a directory traversal to require call leading to local file inclusion which can allow an attacker to gain remote code execution. Notes: - You need to have an admin session to run this poc. - You can use the directory traversal to reach outside of t...

SRC-2019-0020 : Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Vanilla Forums. Authentication is required to exploit this vulnerability, however the authentication can be bypassed. The specific flaw exists within the getSingleIndex...

Vanilla: Vanilla Forums domGetImages getimagesize Unserialize Remote Code Execution Vulnerability (critical)

Summary: An unauthenticated attacker can inject an serialized payload into a phar archive and trigger read access to it via an unprotected getimagesize. The attacker can leverage this to deserialize untrusted data and gain remote code execution. Notes: - THIS BUG IS UNAUTHENTICATED, however you...