xiuno vulnerabilities

Products

• xiunobbs 7

Latest xiuno CVEs

Newest publication first

1. CVE-2020-19914 Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.

   Published 2022-09-07

   Medium·CVSS 6.1 EPSS 0.74%

   Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.

2. CVE-2020-21496 A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitebrief parameter.

   Published 2021-10-04

   Medium·CVSS 6.1 EPSS 0.69%

   A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitebrief parameter.

3. CVE-2020-21495 A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitename parameter.

   Published 2021-10-04

   Medium·CVSS 6.1 EPSS 0.69%

   A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitename parameter.

4. CVE-2020-21494 A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.

   Published 2021-10-04

   Medium·CVSS 6.1 EPSS 0.69%

   A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.

5. CVE-2020-21493 An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.

   Published 2021-10-04

   Medium·CVSS 5.3 EPSS 1.00%

   An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.

6. CVE-2019-19998 Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.

   Published 2019-12-26

   High·CVSS 7.5 EPSS 1.1%

   Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.

7. CVE-2018-15559 The editor in Xiuno BBS 4.0.4 allows stored XSS.

   Published 2018-08-20

   Medium·CVSS 6.1 EPSS 0.67%

   The editor in Xiuno BBS 4.0.4 allows stored XSS.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.