CVE-2021-45822

CVE-2021-45822 describes a stored XSS in Xbtit 3.1 where the request to /ajaxchat/sendChatData.php does not properly validate the n (POST) parameter. This vulnerability allows an attacker to inject and execute malicious JavaScript code, per multiple connected sources (e.g., NVD/Red Hat/CNVD varia...

CVE-2021-45821

Xbtit 3.1 is affected by a blind SQL injection in the sid parameter of ajaxchat/getHistoryChatData.php, exploitable by registered users. The vulnerability arises from a missing filter/escape for SQL statements, enabling extraction of sensitive data (e.g., usernames and passwords) and, in some cas...

CVE-2018-15681

CVE-2018-15681 affects BTITeam XBTIT 2.5.4. The issue: on login, the user’s password hash is rehashed with a weak, predictable salt and stored in a cookie named “pass” that is not HTTPOnly. An attacker who steals this cookie can brute-force the hash to recover the cleartext password. Publicly doc...

CVE-2018-15684

CVE-2018-15684 concerns BTITeam XBTIT where PHP error logs are stored in an open directory (/include/logs) with predictable filenames, enabling full path disclosure and leakage of sensitive data. The vulnerability is described across multiple sources (NVD/NVD-variants) indicating exposure of log ...

CVE-2018-15676

BTITeam XBTIT has a cross-site scripting vulnerability (CVE-2018-15676). The root cause is the use of String.replace and eval, which bypasses the anti-XSS mechanism in includes/crk_protection.php and allows injection/execution of arbitrary JavaScript. The reports describe the vulnerability and ex...

CVE-2018-15680

CVE-2018-15680 affects BTITeam XBTIT 2.5.4 where passwords in the xbtit_users table are stored as unsalted MD5 hashes. The root cause is weak password hashing, enabling context-dependent attackers to brute-force and recover cleartext passwords. Public details in the provided documents confirm the...

CVE-2018-15678

BTITeam XBTIT 2.5.4 contains a reflected cross-site scripting (XSS) vulnerability in the sign-up page ( /index.php?page=signup ) via the act parameter. The NVD entry CVE-2018-15678 documents this issue with CVSS v2 base score 4.3 ( MEDIUM ) and CVSS v3 base score 6.1 ( MEDIUM ), indicating networ...

CVE-2018-17870

CVE-2018-17870 affects BTITeam XBTIT 2.5.4, via an open redirect in the returnto parameter of account_change.php. This CVE is stated as distinct from CVE-2018-15683. The provided NVD entry lists CVSS vectors/scores (2.0: 5.8; 3.0: 6.1) and general exposure (network, no auth for CVSS2; UI required...

CVE-2018-16361

BTITeam XBTIT 2.5.4 is affected in news.php where the id parameter enables cross-site scripting (XSS). The root cause is likely inadequate input handling in news.php, allowing injected script to be executed by victims. No remediation details are provided in the connected documents; therefore, a p...

CVE-2018-15677

BTITeam XBTIT 2.5.4 contains a stored cross-site scripting (XSS) vulnerability in the newsfeed page (/index.php?page=viewnews) where the news item title is not correctly sanitized. The issue can be triggered via standard XSS and is also exploitable through CSRF. The root cause is the failure to p...

CVE-2018-15683

CVE-2018-15683 describes an open redirect vulnerability in BTITeam XBTIT. The issue occurs on the login page where the returnto parameter is not validated, causing an immediate redirect if a user is already authenticated. The connected documents corroborate a related open redirect vulnerability i...

CVE-2018-15679

CVE-2018-15679 affects BTITeam XBTIT 2.5.4. A reflective XSS flaw exists in the keywords parameter of the search function at /index.php?page=forums&action=search, caused by insufficient input sanitization. The vulnerability can allow arbitrary JavaScript execution in a user’s browser. Public fixe...

CVE-2018-15682

BTITeam XBTIT is affected by a cross-site request forgery (CSRF) vulnerability due to missing CSRF protection. An attacker could trick an authenticated user into visiting a page that auto-submits a form to send private messages on behalf of the user. Root cause: CSRF protection absence in the app...