CVE-2004-1982

Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subject field...

CVE-2004-1827

Cross-site scripting XSS vulnerability in YaBB 1 GoldSP1.3 and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in 1 glow or 2 shadow tags...

CVE-2005-0785

Cross-site scripting XSS vulnerability in usersrecentposts in YaBB 2.0 rc1 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2005-0785

Cross-site scripting XSS vulnerability in usersrecentposts in YaBB 2.0 rc1 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2005-0785

CVE-2005-0785 describes a cross-site scripting (XSS) vulnerability in YaBB 2.0 rc1, specifically in the YaBB.pl usersrecentposts action. The issue arises from unsafely handling the username parameter, allowing an attacker to inject arbitrary web script or HTML that could run in a victim’s browser...

yabbXSS.txt

PersianHacker.NET 200503-08 YaBB2 rc1 XSS Vulnerability Date: 2005 March Bug Number: 08 bid:12756 YaBB is a leading free forum software package that rivals any professional message board out there. It provides a real-time chat and support system for your visitors. More info @:...

CVE-2005-0741

YaBB.pl (YaBB 2.0 RC1) contains a cross-site scripting (XSS) flaw in the usersrecentposts action via the username parameter. The vulnerability results in arbitrary script/HTML execution in a user’s browser within the context of the affected site. Documented in CVE-2005-0741 with details from NVD/...

CVE-2005-0741

Cross-site scripting XSS vulnerability in YaBB.pl for YaBB 2.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a usersrecentposts action...

YaBB YaBB.pl usersrecentposts Action username Parameter XSS

The installed version of YaBB Yet Another Bulletin Board on the remote host suffers from a remote cross-site scripting flaw due to its failure to properly sanitize input passed via the 'username' parameter and used as part of the 'usersrecentposts' action. By exploiting this flaw, a remote attack...

CVE-2005-0741

Cross-site scripting XSS vulnerability in YaBB.pl for YaBB 2.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a usersrecentposts action...

YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting

YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting source: https://www.securityfocus.com/bid/12756/info A remote cross-site scripting vulnerability affects YaBB. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically...

YaBB < 2.1 YaBB.pl username Parameter XSS

Binary data 2685.prm...

YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting

source: https://www.securityfocus.com/bid/12756/info A remote cross-site scripting vulnerability affects YaBB. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. An attacker may leverage this issue...

CVE-2004-1662

YaBB SE 1.5.1 is affected by an information disclosure vulnerability where an attacker can obtain sensitive information by directly requesting Admin.php. The vulnerability results in a PHP error message that reveals the full path, potentially aiding further intrusion. No exploitation details are ...

CVE-2004-1662

YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message...

CVE-2004-2139

Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl...

CVE-2004-2140

CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable...

CVE-2004-2754

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the IDMEMBER parameter to the 1 recentTopics and 2 welcome functions...

CVE-2004-2403

Cross-site request forgery CSRF vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters...

CVE-2004-2402

Cross-site scripting XSS vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect...