glfusion glfusion vulnerabilities and exploits

(subscribe to this query)

NA

Multiple cross-site scripting (XSS) vulnerabilities in glFusion prior to 1.2.2.pl4 allow remote malicious users to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4) calendar_type, (5) city, (6) state, (7) title, (8)...

1 EDB exploit

NA

glFusion prior to 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote malicious users to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be lev...

Glfusion Glfusion 1.1.0 Glfusion Glfusion 1.0.0 Glfusion Glfusion 1.0.1 Glfusion Glfusion 1.0.2 Glfusion Glfusion 1.1.1 Glfusion Glfusion

1 EDB exploit

NA

Cross-site scripting (XSS) vulnerability in glFusion prior to 1.1.3 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.

Glfusion Glfusion 1.1.1 Glfusion Glfusion 1.0.0 Glfusion Glfusion 1.0.1 Glfusion Glfusion Glfusion Glfusion 1.1.0

1 EDB exploit

NA

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and previous versions allow remote malicious users to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.ph...

Glfusion Glfusion Glfusion Glfusion 1.1.0 Glfusion Glfusion 1.1.1 Glfusion Glfusion 1.0.0 Glfusion Glfusion 1.0.1

1 EDB exploit

NA

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and previous versions allows remote malicious users to execute arbitrary SQL commands via the glf_session cookie parameter.

Glfusion Glfusion 1.0.1 Glfusion Glfusion 1.0.0 Glfusion Glfusion 1.1.1 Glfusion Glfusion 1.1.0 Glfusion Glfusion

1 EDB exploit

NA

Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and previous versions versions allows remote malicious users to inject arbitrary web script or HTML via the username parameter to comment.php.

Glfusion Glfusion 1.1.0 Glfusion Glfusion

1 EDB exploit

9.1

CVSSv3

glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely without interaction.

Glfusion Glfusion 1.7.9

5.3

CVSSv3

glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied.

Glfusion Glfusion 1.7.9

4.3

CVSSv3

glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist.

Glfusion Glfusion 1.7.9

9.8

CVSSv3

glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

Glfusion Glfusion 1.7.9

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook