Xiuno Xiunobbs — known CVE vulnerabilities

Every CVE whose affected-product data names Xiuno Xiunobbs, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2019-19998 — CVSS 7.5 (high): Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
• CVE-2020-21496 — CVSS 6.1 (medium): A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute…
• CVE-2020-19914 — CVSS 6.1 (medium): Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload…
• CVE-2018-15559 — CVSS 6.1 (medium): The editor in Xiuno BBS 4.0.4 allows stored XSS.
• CVE-2020-21494 — CVSS 6.1 (medium): A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary…
• CVE-2020-21495 — CVSS 6.1 (medium): A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute…
• CVE-2020-21493 — CVSS 5.3 (medium): An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.