LayerBB

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

LayerBB records in CISA KEV

No LayerBB vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Layerbb 7 records MEDIUM

Records

7 records in Layerbb · all components

TI-2019-10422 CVE-2019-13973 · GHSA-fjx8-gwwh-32r7

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo…

MEDIUM 46

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01753 Published 2019-07-19 No fix listed CWE-434

TI-2018-12807 CVE-2018-17988 · GHSA-rc84-w3xr-xww4

LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.

MEDIUM 46

LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02043 Published 2019-03-07 No fix listed CWE-89

TI-2019-12394 CVE-2019-16531 · GHSA-vmr6-p4cg-ph5r

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

MEDIUM 43

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02549 Published 2019-09-20 No fix listed CWE-352

TI-2019-10423 CVE-2019-13974 · GHSA-qppw-r36x-pxx8

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.

LOW 39

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00613 Published 2019-07-19 No fix listed CWE-352

TI-2018-12810 CVE-2018-17996 · GHSA-gv2w-m3wh-vwhw

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a…

LOW 34

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.03011 Published 2019-03-17 No fix listed CWE-352

TI-2018-12811 CVE-2018-17997 · GHSA-c2h7-pxvr-px58

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

LOW 33

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0358 Published 2019-03-17 No fix listed CWE-79

TI-2019-10421 CVE-2019-13972 · GHSA-q859-prqf-vpr3

LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.

LOW 29

LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2019-07-19 No fix listed CWE-79

Open these records in search →

Critical	2
High	3
Medium	3
Low	0
No CVSS	0