Michał Wnękowicz

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Stored Cross-Site Scripting occurs because the application fails to properly sanitize user input in user posts and user profile fields. This allows low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser when the content is viewed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** uBB.threads version 7.7.5 **Description** Lack of protective mechanisms leads to a Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks an authenticated user into performing unintended actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Reflected Cross-Site Scripting (XSS) occurs when the application improperly handles user input in certain requests. This allows attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Insufficient input sanitization in the Members in Control Panel allows attackers to interact with the underlying database via Blind SQL Injection. This technique involves sending queries that the database answers with a boolean (true/false) or a time delay, enabling the extraction of sensitive information such as user credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** Path traversal allows attackers with privileges to edit templates to read and write any file on the application server that the application has permissions to access. This can lead to Remote Code Execution, which is the ability to execute arbitrary commands on the target machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBB.threads version 7.7.5 **Description** An authenticated attacker can cause a Denial of Service (DoS) by sending multiple concurrent requests to view user profiles. On instances with a large number of registered users, this action exhausts database resources, resulting in a complete loss of application access for other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.