Xenforo CVE-2024-38457

Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut

Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code f

OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used

Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi

Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa

Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa

Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators

Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through

OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req

XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by