#1 Trusted Cybersecurity News Platform
Followed by 4.50+ million
Get the Free Newsletter
Host Header Injection | Breaking Cybersecurity News | The Hacker News
0-Day Flaws in Vanilla Forums Let Remote Attackers Hack Websites
May 12, 2017
A security researcher has publicly disclosed two critical zero-day vulnerabilities in Vanilla Forums, an open source software that powers discussion on over 500,000 websites, which could allow unauthenticated, remote attackers to fully compromise targeted websites easily. Discovered by Polish security researcher Dawid Golunski of Legal Hackers, two separate unpatched vulnerabilities, a remote code execution ( CVE-2016-10033 ) and host header injection ( CVE-2016-10073 ), affect the latest version of Vanilla Forums 2.3, leaving hundreds of thousands of websites and their visitors vulnerable to various hacking attacks. Vanilla Forums: Remote Code Execution Flaw According to Golunski, both vulnerabilities technically exist because Vanilla Forum is still using a vulnerable version of PHPMailer , one of the most popular open source PHP libraries used to send emails. Last year Golunski reported a critical remote code execution flaw ( CVE-2016-10033 ) in PHPMailer library that al
Befriend Your Mom with Technology
Explain cybersecurity with Moonlock
Discover Our Unparalleled Threat Detection Capabilities
Try Fidelis Elevate for 30 days and discover threats your current provider missed.
Webinar: A New Approach to Mitigating Insider Risks
Learn how you can easily mitigate the modern security risks introduced by your employees.
Advance in the Field of Cybersecurity with Georgetown
Learn cybersecurity strategies from the experts. Attend a sample class on Nov. 30.
Join 120,000+ Professionals
Sign up for free and start receiving your daily dose of cybersecurity news, insights and tips.