GCVE - cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Vanillaforums (`e59b661e-03d0-5928-b087-75b0895bb418`)
Product	Vanilla Forums (`05f9e18a-3d3a-5c23-97a5-5c1adc9361fd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/vanilla/vanilla`	purl2cpe	2026-06-01 10:18:09.098330

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-8279`	vulnerable	2026-06-08 05:14:23.800164	Details available Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum. Published: 2019-03-02T01:00:00.000Z Updated: 2024-09-17T00:21:56.165Z Open on db.gcve.eu Reference links https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15833`	vulnerable	2026-06-08 05:11:03.645582	Details available In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items). Published: 2018-08-26T17:00:00.000Z Updated: 2024-08-05T10:01:54.600Z Open on db.gcve.eu Reference links https://twitter.com/viperbluff/status/1033067882941304832 https://open.vanillaforums.com/discussion/36559 https://hackerone.com/reports/326434 https://twitter.com/viperbluff/status/1033640333890834433	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000432`	vulnerable	2026-06-08 05:08:34.546593	Details available Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access Published: 2018-01-02T23:00:00.000Z Updated: 2024-08-05T22:00:40.993Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/43462/ https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4266`	vulnerable	2026-06-08 04:55:19.648625	Details available It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher. Published: 2021-06-22T13:38:24.000Z Updated: 2024-08-07T03:43:13.298Z Open on db.gcve.eu Reference links https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4264`	vulnerable	2026-06-08 04:55:19.647402	Details available It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side. Published: 2021-06-22T13:24:04.000Z Updated: 2024-08-07T03:43:13.315Z Open on db.gcve.eu Reference links https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece https://seclists.org/oss-sec/2010/q4/282	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.