XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.
| Vendor | Product | Versions |
|---|---|---|
| xenforo | — | 2.3.0, 0 |
Updated affected versions to include 2.2.17 and 2.3.8, changed severity to CRITICAL, and noted that no exploit is available.
Initial creation
