Discuz

discuz

12 CVEs • 4 products

Products (4)

Click to collapse

Toggle

CVEs (12)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-30884 1Discuz 1Discuzx Jun 17, 2026 Apr 11, 2024 N/A· v4 7.1 HIGH· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in...Show more Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in the misc.php component.Show less
CVE-2022-45543 1Discuz 1Discuzx Jun 17, 2026 Feb 15, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.
CVE-2018-10298 1Discuz 1Discuzx Nov 21, 2024 Apr 22, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does not restrict the content.
CVE-2018-10297 1Discuz 1Discuzx Nov 21, 2024 Apr 22, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associated with remote images.
CVE-2018-5377 1Discuz 1Discuzx Nov 21, 2024 Jan 12, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter.
CVE-2018-5376 1Discuz 1Discuzx Nov 21, 2024 Jan 12, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.
CVE-2018-5375 1Discuz 1Discuzx Nov 21, 2024 Jan 12, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.
CVE-2018-5331 1Discuz 1Discuzx Nov 21, 2024 Jan 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php.
CVE-2018-5259 1Discuz 1Discuzx Nov 21, 2024 Jan 8, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter.
CVE-2010-4912 1Discuz 1Ucenter Home Apr 29, 2026 Oct 8, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands via the shopid parameter in a view action.
CVE-2008-6957 1Discuz 1Discuz! Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.
CVE-2006-5561 1Discuz 1Discuz Gbk Apr 23, 2026 Oct 27, 2006 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in admincp.php in Discuz! GBK 5.0.0 allows remote attackers to execute arbitrary SQL commands via the cdb_auth cookie.