discourse vulnerabilities (Bitnami)
287 vulnerabilities.
discourseBitnamiDiscourse has Stored XSS in AI Triage Automation5.1 MediumdiscourseBitnamiDiscourse Vulnerable to Stored XSS via Shared AI Conversation Onebox5.1 MediumdiscourseBitnamiDiscourse has a bypass of official warnings messages by non-staff users6.9 MediumdiscourseBitnamiDiscourse has check revision visibility on posts endpoint5.3 MediumdiscourseBitnamiDiscourse vulnerable to HTML injection via prohibited iframe URLs4.1 MediumdiscourseBitnamiDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category1.2 LowdiscourseBitnamiPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners1.3 LowdiscourseBitnamiDiscourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution5.3 MediumdiscourseBitnamiDiscourse has XSS when editing a malicious post1.3 LowdiscourseBitnamiDiscourse doesn't prevent moderators from exporting user Chat DMs1.3 LowdiscourseBitnamiDIscourse has DM communication-preference bypass when adding members1.3 LowdiscourseBitnamiDIscourse doesn't prevent whispers to leak in excerpts4.9 MediumdiscourseBitnamiDiscourse doesn't validate destination topic when moving posts1.3 LowdiscourseBitnamiDiscourse doesn't ensure guardian check when creating QueryGroupBookmark1.3 LowdiscourseBitnamiDiscourse has SQL injection in PM tag filtering4.9 MediumdiscourseBitnamiDiscourse: Poll voters endpoint lacked post visibility checks6.9 MediumdiscourseBitnamiDiscourse: TL4 users are able to change status of restricted topics0.0 NonediscourseBitnamiDiscourse doesn't scope reviewable notes to user-visible reviewables4.3 MediumdiscourseBitnamiDiscourse has IDOR vulnerability in the directory items endpoint7.5 HighdiscourseBitnamiDIscourse's discourse-policy plugin lacks post access check5.4 MediumdiscourseBitnamiDiscourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint7.5 HighdiscourseBitnamiDiscourse doesn't ensure webhooks require a token6.5 MediumdiscourseBitnamiDiscourse staff action logs expose sensitive information to moderators6.5 MediumdiscourseBitnamiDiscourse allows permalinks to restricted resources to leak resource slugs to unauthorized users6.9 MediumdiscourseBitnamiDiscourse topic conversion permission vulnerability for moderators6.5 MediumdiscourseBitnamiDiscourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change5.1 MediumdiscourseBitnamiDiscourse moderators can access admin-only reports exposing private upload URLs7.1 HighdiscourseBitnamiDiscourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint6.5 MediumdiscourseBitnamiDiscourse non-admin moderators can exfiltrate private content via post ownership transfer6.9 MediumdiscourseBitnamiDiscourse users archives leaked to users with moderation privileges5.9 MediumdiscourseBitnamiFinalDestination hostname matching allows SSRF protection bypass7.6 HighdiscourseBitnamiDiscourse AI Discover's continue conversation allows threat actor to impersonate user5.3 MediumdiscourseBitnamiDiscourse has DoS vulnerability in username change endpoint4.3 MediumdiscourseBitnamiDiscourse subscriptions are susceptible to takeover7.1 HighdiscourseBitnamiDiscourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin4.6 MediumdiscourseBitnamiDiscourse allows script execution in uploaded HTML/XML files on S34.6 MediumdiscourseBitnamiUsers are able to find users by name even when `enable_names` is off6.3 MediumdiscourseBitnamiDiscourse is missing Cache-Control response header on error responses6.3 MediumdiscourseBitnamiDiscourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments5.5 MediumdiscourseBitnamiDiscourse AI Suggestions Contain Insecure Direct Object Reference4.3 MediumdiscourseBitnamiDiscourse is vulnerable to XSS when quoting chat messages3.5 LowdiscourseBitnamiDiscourse welcome banner user name XSS2.4 LowdiscourseBitnamiDiscourse's WebAuthn challenge isn't cleared from user session after authentication8.2 HighdiscourseBitnamiDiscourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers6.3 MediumdiscourseBitnamiDiscourse vulnerable to XSS via user-provided query parameter in oauth failure flow8.1 HighdiscourseBitnamiDiscourse vulnerable to auto-executing of third-party code in embedded CodePen iframe8.1 HighdiscourseBitnamiDiscourse vulnerable to HTML injection when inviting to topic via email7.1 HighdiscourseBitnamiDiscourse vulnerable to DoS via large URL payload in PM to a bot8.7 HighdiscourseBitnamiDiscourse DM limits aren’t always properly enforced4.8 MediumdiscourseBitnamiDiscourse may bypass user preference when adding users to chat groups4.3 Medium- Show moreLoading…