What’s Vulnerable › Vulnerabilities

CVE-2019-7550

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-12 · updated 2026-06-17
• Weakness: CWE-209

Description

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

Affected products

• Jforum: 2.1.8

References

• https://www.criticalstart.com/2019/02/information-disclosure-in-jforum-2-1-x-syntax/
• https://www.criticalstart.com/2019/02/information-disclosure-in-jforum-2-1-x-syntax/

Get alerted when CVE-2019-7550 or the next vulnerability affects your stack