Discuz! vulnerabilities
We track 3 vulnerabilities in Discuz! products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 15, 2026.
Latest Discuz! vulnerabilities
- 7.2 High severity
Discuz! X5.0: Improper Control of Filename for Include/Require Statement in PHP Program
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the dir
- 9.1 Critical severity
Discuz! X5.0: Reusing a Nonce, Key Pair in Encryption
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key betwe
- 7.1 High severity
discuz\!ml: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in the misc.php component.