Crates.io
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| = 2.6.3 | 5.4 MEDIUM | 3.5 LOW | ||
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS. | ||||
| >= 2.0.17.1, <= 2.0.17.5 | 6.1 MEDIUM | 4.3 MEDIUM | ||
Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter. | ||||
| < 2.0.17.9 | 7.5 HIGH | 5 MEDIUM | ||
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled. | ||||
| < 2.0.17.9 | 9.8 CRITICAL | 7.5 HIGH | ||
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9. | ||||
| < 2.6.4 | — | 4 MEDIUM | ||
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server. | ||||
| >= 2.6.0, < 2.6.2, < 2.5.5 | — | 6.5 MEDIUM | ||
Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class. | ||||
| >= 2.6.0, < 2.6.4 | — | 7.5 HIGH | ||
Vanilla 2.6.x before 2.6.4 allows remote code execution. | ||||
| < 2.6.1 | — | 4.3 MEDIUM | ||
Vanilla before 2.6.1 allows XSS via the email field of a profile. | ||||
| = 2.6.1 | — | 4 MEDIUM | ||
Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php. | ||||