codologic vulnerabilities

Products

• codoforum 8
• com freichat 1

Latest codologic CVEs

Newest publication first

1. CVE-2020-9007 Codoforum 4.8.8 allows self-XSS via the title of a new topic.

   Published 2020-02-16

   Medium·CVSS 5.4

   Codoforum 4.8.8 allows self-XSS via the title of a new topic.

2. CVE-2020-7050 Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is ope...

   Published 2020-02-15

   Medium·CVSS 5.4

   Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal aut...

3. CVE-2020-7051 Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...

   Published 2020-02-13

   Medium·CVSS 6.1

   Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.

4. CVE-2020-5842 Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage p...

   Published 2020-01-07

   Medium·CVSS 6.1

   Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.

5. CVE-2020-5843 Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.

   Published 2020-01-07

   Medium·CVSS 4.8

   Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.

6. CVE-2020-5306 Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

   Published 2020-01-05

   Medium·CVSS 4.8

   Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

7. CVE-2020-5305 Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.

   Published 2020-01-05

   Medium·CVSS 4.8

   Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.

8. CVE-2014-9261 The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path p...

   Published 2015-03-23

   Medium·CVSS 5.0 EPSS 9.0%

   The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.

9. CVE-2013-5952 Multiple cross-site scripting (XSS) vulnerabilities in the Freichat (com_freichat) component, possibly 9.4 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via th...

   Published 2014-03-19

   Medium·CVSS 4.3

   Multiple cross-site scripting (XSS) vulnerabilities in the Freichat (com_freichat) component, possibly 9.4 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) xhash parameter to client/chat.php or (3) toname parameter to cl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.