CVE-2018-18903

Description

References

• vanilla/vanilla release Vanilla_2.6.4 · Release Notes
• open.vanillaforums.com/discussion/36771/security-update-vanilla-2-6-4 · Release Notes
• srcincite.io/blog/2018/10/02/old-school-pwning-with-new-school-tricks-vanilla-forums-remote-code-execution.html · Exploit

Weitere Schwachstellen in vanilla

• CVE-2020-8825MITTEL 5.4index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
• CVE-2011-1009MITTEL 6.1Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.
• CVE-2011-3614KRITISCH 9.8An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
• CVE-2011-3613HOCH 7.5An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
• CVE-2019-9889NIEDRIG 2.7In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call usi…