Xenforo CVE-2024-38457

Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi

Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through

OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req

XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by

Remote code execution in XenForo versions prior to 2.3.9 and 2.2.18 allows authenticated administrators to execute arbit

XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to adm

XenForo before version 2.3.7 exposes sensitive user account information through improper browser caching of account page

Stored cross-site scripting (XSS) in XenForo before 2.3.10 and 2.2.19 allows authenticated attackers to inject malicious

Cross-site scripting (XSS) in XenForo lightbox functionality allows unauthenticated remote attackers to inject malicious

Stored cross-site scripting in XenForo before version 2.3.9 allows authenticated users to inject malicious scripts throu