Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
codoforum vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv2
CVE-2020-21845
Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
Codoforum Codoforum 4.8.3
10
CVSSv2
CVE-2020-13873
A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum prior to 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and exec...
Codologic Codoforum
3.5
CVSSv2
CVE-2020-7050
Codologic Codoforum up to and including 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible ...
Codologic Codoforum
4.3
CVSSv2
CVE-2020-7051
Codologic Codoforum up to and including 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.
Codologic Codoforum
3.5
CVSSv2
CVE-2020-5305
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
Codologic Codoforum 4.8.3
6.5
CVSSv2
CVE-2022-31854
Codoforum v5.1 exists to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
Codologic Codoforum 5.1
5
CVSSv2
CVE-2014-9261
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote malicious users to read arbitrary files via a .. (dot dot) in the path parameter to index.php.
Codologic Codoforum 2.5.1
1 EDB exploit
3.5
CVSSv2
CVE-2020-9007
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
Codologic Codoforum 4.8.8
4.3
CVSSv2
CVE-2020-5842
Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.
Codologic Codoforum 4.8.3
1 Github repository
3.5
CVSSv2
CVE-2020-5843
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
Codologic Codoforum 4.8.3
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
SSRF
buffer overflow
CVE-2023-28952
CVE-2023-41822
CVE-2024-27956
CVE-2023-7028
CVE-2024-34447
CVE-2024-34460
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »