Dino is a niche collaboration and discussion-board platform whose vulnerability profile centers on access-control and path-handling weaknesses including path traversal, origin validation errors, authorization bypass through user-controlled keys, and missing authorization checks. The vendor's disclosures frequently acquire public exploit code, underscoring the appeal of web-facing discussion platforms to researchers and attackers. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dino over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-4075MEDIUM Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter. | Sep 15, 2008 | 6.8 | 27 | NO | YES |
CVE-2019-16236HIGH Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. | Sep 11, 2019 | 7.5 | 25 | NO | NO |
CVE-2019-16237HIGH Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. | Sep 11, 2019 | 7.5 | 24 | NO | NO |
CVE-2019-16235HIGH Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. | Sep 11, 2019 | 7.5 | 24 | NO | NO |
CVE-2023-28686HIGH Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of g | Mar 24, 2023 | 7.1 | 23 | NO | NO |
CVE-2021-33896MEDIUM Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. | Jun 7, 2021 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dino.
Media articles that mention a CVE ID that affects a product developed by Dino — matched by CVE ID, not by vendor name.