vanillaforums vanilla forums vulnerabilities

Latest vanillaforums vanilla forums CVEs

Newest publication first

1. CVE-2010-4266 It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.

   Published 2021-06-22

   Medium·CVSS 6.1 EPSS 0.58%

   It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.

2. CVE-2010-4264 It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.

   Published 2021-06-22

   Medium·CVSS 6.1 EPSS 0.66%

   It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.

3. CVE-2019-8279 Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.

   Published 2019-03-02

   Medium·CVSS 5.4 EPSS 0.81%

   Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.

4. CVE-2018-15833 In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote f...

   Published 2018-08-26

   Medium·CVSS 4.3 EPSS 0.88%

   In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).

5. CVE-2017-1000432 Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access

   Published 2018-01-02

   High·CVSS 8.0 EPSS 1.6% Public exploit

   Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access

6. CVE-2014-9685 Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

   Published 2015-02-25

   Medium·CVSS 4.3 EPSS 1.8%

   Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

7. CVE-2012-4954 The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to...

   Published 2012-11-15

   Low·CVSS 3.5 EPSS 1.1%

   The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.