Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2024-22284

WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2025-32227

WordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability

Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a through <= 3.0.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros Wordpress
Products
Asgaros Forum Wordpress
CVE-2024-32440

WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2025-39514

WordPress Asgaros Forum plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.This issue affects Asgaros Forum: from n/a through <= 3.2.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2025-11452

Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Asgaros Wordpress
Products
Asgaros Forum Wordpress
CVE-2025-12901

Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros Wordpress
Products
Asgaros Forum Wordpress
CVE-2023-5604

Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2021-42365

Asgaros Forums <= 1.15.13 Authenticated Stored XSS

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2022-41608

WordPress Asgaros Forum Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum plugin <= 2.2.0 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2022-0411

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2021-25045

Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum
CVE-2021-24827

Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue

CVSS 3.1 · 9.8 Critical EPSS 12.6% KEV · Not listed
Vendors
Asgaros
Products
Asgaros Forum