Codoforum (Codologic) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 10 known versions, newest CVE from 2024-04-15. Vendor: Codologic.
CVEs of Codoforum
- CVE-2020-22540 - CVSS 5.4 (medium), 2024-04-15: Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted…
- CVE-2020-22539 - CVSS 7.2 (high), 2024-04-15: An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2022-31854 - CVSS 7.2 (high), 2022-07-07: Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
- CVE-2020-25879 - CVSS 5.4 (medium), 2021-07-09: A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web…
- CVE-2020-25876 - CVSS 5.4 (medium), 2021-07-09: A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts…
- CVE-2020-25875 - CVSS 5.4 (medium), 2021-07-09: A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts…
- CVE-2020-13873 - CVSS 9.8 (critical), 2021-05-12: A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass…
- CVE-2020-9007 - CVSS 5.4 (medium), 2020-02-16: Codoforum 4.8.8 allows self-XSS via the title of a new topic.
- CVE-2020-7050 - CVSS 5.4 (medium), 2020-02-15: Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically…
- CVE-2020-7051 - CVSS 6.1 (medium), 2020-02-13: Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the…
- CVE-2020-5842 - CVSS 6.1 (medium), 2020-01-07: Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed…
- CVE-2020-5843 - CVSS 4.8 (medium), 2020-01-07: Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
- CVE-2020-5306 - CVSS 4.8 (medium), 2020-01-05: Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.
- CVE-2020-5305 - CVSS 4.8 (medium), 2020-01-05: Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
- CVE-2014-9261 - CVSS 5 (medium), 2015-03-23: The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read…
