2.6.1

DATE	CVE	VULNERABILITY TITLE	RISK
2019-03-21	CVE-2019-9889	Path Traversal vulnerability in Vanillaforums Vanilla In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. network low complexity vanillaforums CWE-22	2.7
2018-11-23	CVE-2018-19499	Deserialization of Untrusted Data vulnerability in Vanillaforums Vanilla Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class. network low complexity vanillaforums CWE-502	7.2
2018-11-03	CVE-2018-18903	Code Injection vulnerability in Vanillaforums Vanilla 2.6.0/2.6.1/2.6.3 Vanilla 2.6.x before 2.6.4 allows remote code execution. network low complexity vanillaforums CWE-94 critical	9.8
2018-09-03	CVE-2018-16410	SQL Injection vulnerability in Vanillaforums Vanilla 2.6.1 Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php. network low complexity vanillaforums CWE-89	6.5