GCVE - cpe:2.3:a:vanillaforums:vanilla:2.0.17:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vanillaforums:vanilla:2.0.17:*:*:*:*:*:*:*

part: a version: 2.0.17 update: *

Vendor	Vanillaforums (`e59b661e-03d0-5928-b087-75b0895bb418`)
Product	Vanilla (`7643dc8c-e1f4-59db-ad0b-7c9fe47202a5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/vanilla/vanilla`	purl2cpe	2026-06-01 10:18:09.109427

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-3528`	vulnerable	2026-06-08 05:04:31.955811	Details available Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection." Published: 2013-05-10T21:00:00.000Z Updated: 2024-08-06T16:14:56.297Z Open on db.gcve.eu Reference links http://vanillaforums.org/discussion/23339/security-update-vanilla-2-0-18-7 https://github.com/vanillaforums/Garden/commit/b9a10dabb15c697347bfa7baef69a6e211b2f804 https://exchange.xforce.ibmcloud.com/vulnerabilities/84167	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3527`	vulnerable	2026-06-08 05:04:31.942110	Details available Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest. Published: 2013-05-10T21:00:00.000Z Updated: 2024-08-06T16:14:56.610Z Open on db.gcve.eu Reference links http://secunia.com/advisories/52825 http://archives.neohapsis.com/archives/bugtraq/2013-04/0068.html http://osvdb.org/92109 http://vanillaforums.org/discussion/23339/security-update-vanilla-2-0-18-7 http://packetstormsecurity.com/files/121151/Vanilla-Forums-2.0.18.4-SQL-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4954`	vulnerable	2026-06-08 05:02:53.355040	Details available The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue. Published: 2012-11-15T11:00:00.000Z Updated: 2024-08-06T20:50:18.236Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/56483 https://exchange.xforce.ibmcloud.com/vulnerabilities/80000 http://www.kb.cert.org/vuls/id/611988	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0910`	vulnerable	2026-06-08 04:56:40.181271	Details available The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks. Published: 2011-02-08T20:00:00.000Z Updated: 2024-09-16T20:42:07.541Z Open on db.gcve.eu Reference links http://www.vanillaforums.org/discussion/comment/134729/#Comment_134729	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0909`	vulnerable	2026-06-08 04:56:40.180729	Details available Cross-site scripting (XSS) vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526. Published: 2011-02-08T20:00:00.000Z Updated: 2024-09-17T04:09:23.985Z Open on db.gcve.eu Reference links http://www.vanillaforums.org/discussion/comment/134729/#Comment_134729	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0908`	vulnerable	2026-06-08 04:56:40.178103	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.