← Back

Sir

sir

42 CVEs • 3 products

Products (3)

Click to collapse
Toggle
Gnuboard
gnuboard
39 CVEs
Gnucommerce
gnucommerce
2 CVEs
Youngcart5
youngcart5
1 CVE

CVEs (42)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-18668
1Sir
1Gnuboard
Nov 21, 2024
Aug 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.
CVE-2017-18572
1Sir
1Gnucommerce
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
CVE-2016-10920
1Sir
1Gnucommerce
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
CVE-2018-18676
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/board_form_update.php bo_mobile_content_tail parameter.
CVE-2018-18675
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/board_form_update.php bo_mobile_subject parameter.
CVE-2018-18672
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/board_form_update.php bo_content_head parameter.
CVE-2018-18670
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter, aka the adm/config_form_update.php cf_1~10 parameter.
CVE-2018-18673
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menu_list_update.php me_link parameter.
CVE-2018-18671
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/board_form_update.php bo_mobile_content_head parameter.
CVE-2018-18669
1Sir
1Gnuboard
Nov 21, 2024
Jul 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/board_form_update.php bo_subject parameter.
CVE-2018-15584
1Sir
1Gnuboard
Nov 21, 2024
Apr 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15582
1Sir
1Gnuboard
Nov 21, 2024
Apr 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15581
1Sir
1Gnuboard
Nov 21, 2024
Apr 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15580
1Sir
1Gnuboard
Nov 21, 2024
Apr 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15585
1Sir
1Gnuboard
Nov 21, 2024
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2018-15583
1Sir
1Gnuboard
Nov 21, 2024
Mar 25, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2014-2339
1Sir
1Gnuboard
May 6, 2026
Mar 19, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
CVE-2012-4873
1Sir
1Gnuboard
Apr 29, 2026
Sep 6, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2011-4066
1Sir
1Gnuboard
Apr 29, 2026
Nov 4, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVE-2009-0290
1Sir
1Gnuboard
Apr 23, 2026
Jan 27, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this...Show more
Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname.Show less