Vulnerabilities

TI-2021-22567 CVE-2021-47954 · GHSA-c38h-whgr-4j82

LayerBB 1.1.4 SQL Injection via search_query Parameter

HIGH 77

LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00237 Published 2026-05-16 No fix listed CWE-89

TI-2019-12394 CVE-2019-16531 · GHSA-vmr6-p4cg-ph5r

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

MEDIUM 43

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02549 Published 2019-09-20 No fix listed CWE-352

TI-2019-10423 CVE-2019-13974 · GHSA-qppw-r36x-pxx8

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.

LOW 39

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00613 Published 2019-07-19 No fix listed CWE-352

TI-2019-10422 CVE-2019-13973 · GHSA-fjx8-gwwh-32r7

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo…

MEDIUM 46

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01753 Published 2019-07-19 No fix listed CWE-434

TI-2019-10421 CVE-2019-13972 · GHSA-q859-prqf-vpr3

LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.

LOW 29

LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2019-07-19 No fix listed CWE-79

TI-2018-12811 CVE-2018-17997 · GHSA-c2h7-pxvr-px58

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

LOW 33

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0358 Published 2019-03-17 No fix listed CWE-79

TI-2018-12810 CVE-2018-17996 · GHSA-gv2w-m3wh-vwhw

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a…

LOW 34

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.03011 Published 2019-03-17 No fix listed CWE-352

TI-2018-12807 CVE-2018-17988 · GHSA-rc84-w3xr-xww4

LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.

MEDIUM 46

LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02043 Published 2019-03-07 No fix listed CWE-89

Vulnerabilities

Filters