HOMEVULNERABILITIESVENDORSLayerbb

LayerbbCVEs & Vulnerabilities

7 CVEs affecting Layerbb products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

7 CVEs→ All vendors

Most Affected Products

layerbb 8
CVE-2019-16531HIGHpoc

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

20 Sep 2019
8.8
CVSS
CVE-2019-13974HIGH

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.

19 Jul 2019
8.8
CVSS
CVE-2019-13973CRITICAL

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.

19 Jul 2019
9.8
CVSS
CVE-2019-13972MEDIUM

LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.

19 Jul 2019
6.1
CVSS
CVE-2018-17997MEDIUMpoc

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

21 Mar 2019
6.1
CVSS
CVE-2018-17996MEDIUMpoc

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

21 Mar 2019
6.5
CVSS
CVE-2018-17988CRITICAL

LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.

8 Mar 2019
9.8
CVSS
← PrevPage 1 / 1Next →
← All Vendors·CVE Database