Vulnerabilities

TI-2020-14350 CVE-2020-22540 · GHSA-7fq4-6h7w-vrrr

Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to…

LOW 25

Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00425 Published 2024-04-15 No fix listed CWE-79

TI-2020-14349 CVE-2020-22539 · GHSA-x28v-j697-2r2c

An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9…

HIGH 67

An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0086 Published 2024-04-15 No fix listed CWE-434

TI-2022-13712 CVE-2022-31854 · GHSA-jppf-9gf2-jv53

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the…

MEDIUM 56

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.32483 Published 2022-07-07 No fix listed CWE-434

TI-2020-15859 CVE-2020-25875 · GHSA-jcg8-r4fv-m3m8

A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum…

LOW 25

A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Smiley Code' pa…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00507 Published 2021-07-09 No fix listed CWE-79

TI-2020-15860 CVE-2020-25876 · GHSA-6vpr-xxr9-x356

A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum…

LOW 25

A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Page Title' param…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00454 Published 2021-07-09 No fix listed CWE-79

TI-2020-15863 CVE-2020-25879 · GHSA-qq5v-h5vq-gchm

A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of…

LOW 25

A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Username…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00454 Published 2021-07-09 No fix listed CWE-79

TI-2020-10857 CVE-2020-13873 · GHSA-hh89-v8x4-q57w

A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in…

MEDIUM 50

A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04915 Published 2021-05-12 No fix listed CWE-89

TI-2020-07227 CVE-2020-9007 · GHSA-jc25-c7hj-7p6j

Codoforum 4.8.8 allows self-XSS via the title of a new topic.

LOW 25

Codoforum 4.8.8 allows self-XSS via the title of a new topic.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-02-16 No fix listed CWE-79

TI-2020-05690 CVE-2020-7050 · GHSA-cqq4-5rgr-mmrf

Codologic Codoforum through 4.8.4 allows a DOM-based XSS.

LOW 25

Codologic Codoforum through 4.8.4 allows a DOM-based XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2020-02-15 No fix listed CWE-732

TI-2020-05691 CVE-2020-7051 · GHSA-7j87-m9r6-9c5r

Codologic Codoforum through 4.8.4 allows stored XSS in the login area.

LOW 29

Codologic Codoforum through 4.8.4 allows stored XSS in the login area.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00757 Published 2020-02-13 No fix listed CWE-732

TI-2020-04763 CVE-2020-5842 · GHSA-p258-72gh-7cxv

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the…

LOW 31

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01816 Published 2020-01-07 No fix listed CWE-79

TI-2020-04764 CVE-2020-5843 · GHSA-xcqv-q27j-c7xx

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.

LOW 23

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00547 Published 2020-01-07 No fix listed CWE-79

TI-2020-04362 CVE-2020-5306 · GHSA-578r-jv64-7v29

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

LOW 24

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0112 Published 2020-01-05 No fix listed CWE-79

TI-2020-04361 CVE-2020-5305 · GHSA-wwhr-xmj9-h562

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.

LOW 23

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00572 Published 2020-01-05 No fix listed CWE-79

TI-2014-07516 CVE-2014-9261 · GHSA-xmr6-xwc6-6hv4

The sanitize function in Codoforum 2.5.1 does not properly implement filtering for…

LOW 34

The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.09038 Published 2015-03-23 No fix listed CWE-22

Vulnerabilities

Filters