CVE-2021-28377

CVE-2021-28377 : ChronoForums 2.0.11 is vulnerable to local file inclusion via path traversal in the avatar function, enabling an attacker to read arbitrary files (e.g., configuration files containing credentials). Affected product: ChronoForums/Joomla extension. Root cause: unauthenticated path ...

CVE-2021-28376

ChronoForms 7.0.7 is affected by a directory traversal vulnerability (fname path traversal) that allows reading arbitrary files outside restricted directories. The issue originates from insufficient filtering of special path elements in resource/file paths in ChronoForms 7.0.7. The vulnerability ...

CVE-2020-27459

CVE-2020-27459 affects Chronoforeum 2.0.11. The issue is a Stored XSS vulnerability introduced when inserting a crafted payload into a post; if any user views the post, the injected script can execute in their browser. Documents consistently reference Chronoforeum 2.0.11 and the post-insertion pa...