Advisories · Technology
XenForo.
Every CVE that names XenForo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
- XenForo
- Path traversal
- CVSS 7.1 High
XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
- XenForo
- Denial of service
- CVSS 5.1 Medium
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
- XenForo
- Broken access control
- CVSS 5.1 Medium
XenForo < 2.3.13 XSS via Dynamic Redirect Handler
- XenForo
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
- XenForo
- Broken access control
- CVSS 5.1 Medium
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
- XenForo
- Broken access control
- CVSS 8.7 High
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
- XenForo
- CWE-345
- CVSS 7.7 High
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
- XenForo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
- XenForo
- CWE-754
- CVSS 7.6 High
XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
- XenForo
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- XenForo
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- XenForo
- Authentication bypass
- CVSS 8.2 High
XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
- XenForo
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- XenForo
- CWE-697
- CVSS 5.1 Medium
XenForo Stored Cross-Site Scripting via Structured Text Mentions
- XenForo
- Cross-site scripting (XSS)
- CVSS 8.6 High
XenForo Remote Code Execution via Authenticated Admin
- XenForo
- Code injection
- CVSS 5.1 Medium
XenForo Cross-Site Scripting via Lightbox in Posts
- XenForo
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
XenForo Stored Cross-Site Scripting via BB Code Rendering
- XenForo
- Cross-site scripting (XSS)
- CVSS 8.7 High
XenForo Path Disclosure via open_basedir Exceptions
- XenForo
- Information disclosure
- CVSS 8.7 High
XenForo Template Method Call Restriction Bypass
- XenForo
- Code injection
- CVSS 6.9 Medium
XenForo Local Account Page Caching Information Disclosure
- XenForo
- Information disclosure
- CVSS 9.3 CriticalCritical · CVSS 9+
XenForo Passkey Security Bypass
- XenForo
- Authentication bypass
- CVSS 8.7 High
XenForo OAuth2 Unauthorized Scope Request
- XenForo
- Broken access control
- CVSS 5.3 Medium
XenForo Open Redirect via getDynamicRedirect
- XenForo
- Open redirect
- CVSS 5.1 Medium
Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories
- Xenforo
- Cross-site scripting (XSS)