Vulnerabilities

TI-2024-20381 CVE-2024-30884 · GHSA-f83j-8cc9-3p7f

Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811…

MEDIUM 64

Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00526 Published 2024-04-11 No fix listed CWE-79

TI-2022-22486 CVE-2022-45543 · GHSA-ch75-4hc2-84c6

Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute…

MEDIUM 60

Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00535 Published 2023-02-15 No fix listed CWE-79

TI-2018-07296 CVE-2018-10298 · GHSA-9j3q-3vfv-q6mh

Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread…

LOW 25

Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does not restrict the content.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00513 Published 2018-04-22 No fix listed CWE-79

TI-2018-07295 CVE-2018-10297 · GHSA-xpwj-39c3-7v9j

Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article…

LOW 25

Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associated with remote images.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00513 Published 2018-04-22 No fix listed CWE-79

TI-2018-03910 CVE-2018-5377 · GHSA-mp5g-vcww-pfhw

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via…

MEDIUM 46

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02093 Published 2018-01-12 No fix listed CWE-862

TI-2018-03909 CVE-2018-5376 · GHSA-pggr-62xp-w65f

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.

LOW 29

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00831 Published 2018-01-12 No fix listed CWE-79

TI-2018-03908 CVE-2018-5375 · GHSA-3hhq-4v73-93mg

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.

LOW 29

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00829 Published 2018-01-12 No fix listed CWE-79

TI-2018-03872 CVE-2018-5331 · GHSA-m494-44p8-mhr9

Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as…

LOW 25

Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00641 Published 2018-01-10 No fix listed CWE-79

TI-2018-03813 CVE-2018-5259 · GHSA-4476-jj98-xj5g

Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended…

MEDIUM 42

Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01964 Published 2018-01-08 No fix listed

Vulnerabilities

Filters