CVE-2021-43103

The CVE-2021-43103 entry concerns a File Upload vulnerability in the BBS 5.3 web forum software. The connected sources specify that the flaw exists in ForumManageAction.java in the GetType function, allowing a remote attacker to execute arbitrary code. Affected component: BBS 5.3; vulnerability t...

CVE-2021-43097

The provided connected documents indicate CVE-2021-43097 affects the bbs 5.3 web application, specifically a Server-side Template Injection (SSTI) in TemplateManageAction.java that could allow a malicious user to execute arbitrary code. This establishes the component/file and the underlying vulne...

CVE-2021-43099

CVE-2021-43099 is a Zip Slip-style vulnerability in the bbs 5.3 UpgradeNow function (UpgradeManageAction.java) that unzips uploaded archives without validating filenames, enabling directory traversal (e.g., ../../evil.exe). The CVE description and connected sources confirm the affected component ...

CVE-2021-43102

CVE-2021-43102 describes a remote code execution flaw in the Bulletin Board System (bbs) 5.3. The vulnerability is triggered through a file upload path involving HelpManageAction.java in the GetType function, enabling a remote attacker to execute arbitrary code on the affected system. The connect...

CVE-2021-43100

CVE-2021-43100 affects bbs 5.3, where a File Upload vulnerability exists in TopicManageAction.java (GetType function). This allows a remote attacker to execute arbitrary code due to improper handling of uploaded content. The vulnerability is documented across multiple sources (NVD entry and corro...

CVE-2021-43098

CVE-2021-43098 describes a file upload vulnerability in the open-source forum software bbs v5.3 , originating from the QuestionManageAction.java file, within its getType function. The connected documents confirm the affected product and the exact location in code but do not provide concrete explo...

CVE-2021-43101

CVE-2021-43101 corresponds to a file upload vulnerability in bbs 5.3, exploitable via MembershipCardManageAction.java in GetType, enabling remote code execution. The connected sources corroborate a web forum software flaw permitting arbitrary code execution through unvalidated uploads. Affected c...

CVE-2025-6453

CVE-2025-6453 affects diyhi bbs version 6.8 in the API component, specifically the Add function in ForumManageAction.java. The root cause is improper handling of the dirName argument, enabling path traversal. The vulnerability is exploitable remotely and public exploit details have been disclosed...

CVE-2025-6762

CVE-2025-6762 affects diyhi bbs up to version 6.8. The issue is in the HTTP Header Handler’s getUrl function for /admin/login, where manipulating the Host argument enables server-side request forgery (SSRF). Exploitation is possible remotely and has been disclosed publicly. Connected documents co...

CVE-2025-9461

CVE-2025-9461 affects diyhi bbs (versions up to 6.8; update to 6.9+ recommended) in the File Compression Handler, specifically in FilePackageManageAction.java. The vulnerability stems from manipulation of the idGroup argument, leading to information disclosure. Remote exploitation is possible and...