quite frankly, forum security - like any other types of security - SUCKS HORRIBLYYY. there is a large forum vendor which is riddled with vulnerabilities, to give you context here are vague summaries of the vulnerabilities ive found in certain forum software:

1. broken access control: any moderator, without the right privileges, is able to see user's data which should only be limited to admins.
2. any user is able to grab another user's ip address, without any interaction or alert.
3. any user is able to upload files which are prohibited.

keep in mind, i only spent like.. an hour or two, doing a basic audit of the web interface part - i didnt even disassemble and decompile the binaries for potentially more serious vulnerabilities. and ofc, i reported all vulnerabilites to the vendor (which they claim they reply and triage within 24 hours - but its taking weeks :sob:)

the point is. uhhhm. there is no point, just be careful online.