Show filters
11 Total Results
Displaying 1-10 of 11
Sort by:
Attacker Value
Unknown
CVE-2022-45543
Disclosure Date: February 15, 2023 (last updated February 24, 2025)
Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.
0
Attacker Value
Unknown
CVE-2018-10297
Disclosure Date: April 22, 2018 (last updated November 26, 2024)
Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associated with remote images.
0
Attacker Value
Unknown
CVE-2018-10298
Disclosure Date: April 22, 2018 (last updated November 26, 2024)
Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does not restrict the content.
0
Attacker Value
Unknown
CVE-2018-5375
Disclosure Date: January 12, 2018 (last updated November 26, 2024)
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.
0
Attacker Value
Unknown
CVE-2018-5377
Disclosure Date: January 12, 2018 (last updated November 26, 2024)
Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter.
0
Attacker Value
Unknown
CVE-2018-5376
Disclosure Date: January 12, 2018 (last updated November 26, 2024)
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.
0
Attacker Value
Unknown
CVE-2018-5331
Disclosure Date: January 10, 2018 (last updated November 26, 2024)
Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php.
0
Attacker Value
Unknown
CVE-2018-5259
Disclosure Date: January 08, 2018 (last updated November 26, 2024)
Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter.
0
Attacker Value
Unknown
CVE-2010-4912
Disclosure Date: October 08, 2011 (last updated October 04, 2023)
SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands via the shopid parameter in a view action.
0
Attacker Value
Unknown
CVE-2008-6957
Disclosure Date: August 12, 2009 (last updated October 04, 2023)
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.
0
