CVE-2019-7550: Jforum

Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days.

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

Affected products

• Jforum Jforum: version 2.1.8 only

Published 2019-02-12. Last modified 2026-06-17.