CVE-2010-4266

< 2.0.10

It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.

6.1MEDIUM

CVE-2010-4264

< 2.0.10

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to

6.1MEDIUM

CVE-2020-8825

all versions

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

5.4MEDIUM

CVE-2011-1009

>= 2.0.17.1 and <= 2.0.17.5

Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.

6.1MEDIUM

CVE-2011-3614

< 2.0.17.9

An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.

9.8CRITICAL

CVE-2011-3613

< 2.0.17.9

An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.

7.5HIGH

CVE-2019-9889

< 2.6.4

In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a requir

2.7LOW

CVE-2019-8279

< 2.5.0

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on fo

5.4MEDIUM

CVE-2018-19499

< 2.5.5

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable cal

7.2HIGH

CVE-2018-18903

>= 2.6.0 and < 2.6.4

Vanilla 2.6.x before 2.6.4 allows remote code execution.

9.8CRITICAL

CVE-2018-17571

< 2.6.1

Vanilla before 2.6.1 allows XSS via the email field of a profile.

6.1MEDIUM

CVE-2018-16410

all versions

Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboar

6.5MEDIUM

CVE-2018-15833

< 2.6.1

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the

4.3MEDIUM

CVE-2017-1000432

< 2.1.5

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access

8.0HIGH

CVE-2016-10073

<= 2.3.0

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain i

7.5HIGH

CVE-2014-9685

<= 2.0.18.12

Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attacke

CVE-2012-6555

all versions

Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbi

CVE-2013-3528

<= 2.0.18.7

Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors,

CVE-2013-3527

<= 2.0.18.7

Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands

CVE-2012-4954

<= 2.0.18.4

The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by re

CVE-2011-3812

all versions

Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the inst

CVE-2011-0910

<= 2.0.17.5

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and con

CVE-2011-0909

<= 2.0.17.5

Cross-site scripting (XSS) vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script

CVE-2011-0908

<= 2.0.17.5

Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and

CVE-2011-0526

<= 2.0.16

Cross-site scripting (XSS) vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary