Comsenz
Monthly
SQL injection in the Admin Medal Moderation module of Comsenz Discuz! X5.0 affects builds X5.0-20260801, X5.0-20260820 and X5.0-20260910, where the modmedalsubmit() handler in upload/source/app/admin/child/medals/mod.php passes the user-supplied 'delete' argument into a SQL query without proper sanitization. Exploitation requires an authenticated administrator session on the admin panel (CVSS PR:H) and the attack is deliverable remotely, so the practical risk is moderate rather than top-priority despite network reachability. Publicly available exploit code exists (CVSS 4.0 E:P), but there is no evidence of confirmed active exploitation and the issue is not in CISA KEV; the vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified at time of analysis.
Discuz!. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Discuz!. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Discuz!. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in DuomiCMS 3.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in DuomiCMS 3.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Admin Medal Moderation module of Comsenz Discuz! X5.0 affects builds X5.0-20260801, X5.0-20260820 and X5.0-20260910, where the modmedalsubmit() handler in upload/source/app/admin/child/medals/mod.php passes the user-supplied 'delete' argument into a SQL query without proper sanitization. Exploitation requires an authenticated administrator session on the admin panel (CVSS PR:H) and the attack is deliverable remotely, so the practical risk is moderate rather than top-priority despite network reachability. Publicly available exploit code exists (CVSS 4.0 E:P), but there is no evidence of confirmed active exploitation and the issue is not in CISA KEV; the vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified at time of analysis.
Discuz!. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Discuz!. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Discuz!. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in DuomiCMS 3.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in DuomiCMS 3.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.