0Xb9

Cross-site scripting issues allow the injection of malicious scripts via thread titles, post content, and user profile fields such as `Location` and `Bio`. Additionally, a cross-site request forgery flaw exists in the 'timeline.php' profile action, enabling attackers to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.

A denial of service issue allows local attackers to crash the application by inputting an excessively long string in the search bar. The crash is triggered when an attacker pastes a buffer of 2000 characters into the search field, executes a search, and selects any result.

The MyBB Delete Account Plugin contains a cross-site scripting issue in the account deletion reason input field. An attacker can inject malicious scripts that will execute in the admin interface when viewing delete account reasons. The vulnerable input allows for the injection of scripts that impact the admin interface.

The issue is an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with admin or higher user role privileges can potentially include and execute local files on the system, which could lead to sensitive information disclosure or code execution. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher user role privileges can potentially include and execute local files on the system.

The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and execute local files on the server. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard. This can lead to malicious script execution.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly sanitised and escaped before being outputted back in an attribute in the admin dashboard.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard.

The issue arises from the improper sanitization of the slider import search feature and the `tab` parameter in the plugin's settings, which can lead to Reflected Cross-Site Scripting issues.

The issue allows any authenticated users, such as subscribers, to change settings due to a lack of capability and CSRF checks. This can also be exploited through CSRF if user registration is not possible. Additionally, the cookie banner setting is not properly sanitized or validated before being output on all frontend and backend pages, leading to a Stored Cross-Site Scripting issue.

The issue is related to the slider import search feature, which did not properly sanitize the `keyword` GET parameter, leading to a reflected Cross-Site Scripting issue.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back.

The issue is related to a reflected Cross-Site Scripting problem. The settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11.1 Description: The issue allows an attacker to perform Cross-Site Request Forgery, enabling them to make a logged-in administrator add, edit, or delete form fields. This could also lead to Stored Cross-Site Scripting issues. Recommendations: For versions prior to 5.11.1, update to version 5.11.1 or later to resolve the issue.

The issue allows an attacker to perform a Cross-Site Request Forgery, enabling them to make a logged-in administrator update arbitrary payment history. This can include changing the status of payments, for example, from pending to completed.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11 Description: The issue allows an attacker to make a logged-in administrator import files due to a Cross-Site Request Forgery problem. Additionally, the plugin's failure to validate uploaded files could lead to Remote Code Execution (RCE). Recommendations: For versions prior to 5.11, update to version 5.11 or later to resolve the issue. As a temporary workaround, consider restricting file import functionality to minimize the risk of exploitation. Avoid using the file import feature until the issue is resolved.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected.

The issue allows any registered user to leave an XSS payload in the plugin settings, which can be triggered by any user visiting them. This could potentially allow for privilege escalation. The estimated number of potentially affected devices is not specified.