ralph capper tinyphpforum 3.48 vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and previous versions allows remote malicious users to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.

Ralph Capper Tinyphpforum 3.46 Ralph Capper Tinyphpforum 3.47 Ralph Capper Tinyphpforum 3.48 Ralph Capper Tinyphpforum 3.49 Ralph Capper Tinyphpforum 3.499 Ralph Capper Tinyphpforum 3.5 Ralph Capper Tinyphpforum 3.6

TinyPHPForum 3.6 and previous versions stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote malicious users to list all registered users and possibly obtain other sensitive information.

Ralph Capper Tinyphpforum 3.47 Ralph Capper Tinyphpforum 3.48 Ralph Capper Tinyphpforum 3.49 Ralph Capper Tinyphpforum 3.499 Ralph Capper Tinyphpforum 3.46 Ralph Capper Tinyphpforum 3.5 Ralph Capper Tinyphpforum 3.6

1 EDB exploit

Directory traversal vulnerability in TinyPHPForum 3.6 and previous versions allows remote malicious users to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.

Ralph Capper Tinyphpforum 3.47 Ralph Capper Tinyphpforum 3.48 Ralph Capper Tinyphpforum 3.49 Ralph Capper Tinyphpforum 3.499 Ralph Capper Tinyphpforum 3.46 Ralph Capper Tinyphpforum 3.5 Ralph Capper Tinyphpforum 3.6

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook