Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.