CVE-2018-17996

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

• CWE-352

• http://packetstormsecurity.com/files/151694/LayerBB-1.1.2-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/AndyRixon/LayerBB/commits/masterPatch, Third Party Advisory
• https://github.com/AndyRixon/LayerBB/issues/38Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46379/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/151694/LayerBB-1.1.2-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/AndyRixon/LayerBB/commits/masterPatch, Third Party Advisory
• https://github.com/AndyRixon/LayerBB/issues/38Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46379/Exploit, Third Party Advisory, VDB Entry

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17986rars/user/data in razorCMS 3.4.8 allows CSRF for changing th…
• CVE-2018-17987The determineWinner function of a smart contract implementat…
• CVE-2018-17988LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php…9.8
• CVE-2018-17989A stored XSS vulnerability exists in the web interface on D-…
• CVE-2018-1799IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Se…6.2
• CVE-2018-17990An issue was discovered on D-Link DSL-3782 devices with firm…
• CVE-2018-17997LayerBB 1.1.1 allows XSS via the titles of conversations (PM…
• CVE-2018-1800IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2…5.1
• CVE-2018-18004Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network…
• CVE-2018-18005Cross-site scripting in event_script.js in VIVOTEK Network C…
• CVE-2018-18006Hardcoded credentials in the Ricoh myPrint application 2.9.2…
• CVE-2018-18007atbox.htm on D-Link DSL-2770L devices allows remote unauthen…9.8