CVE Daily – phpBB https://cvedaily.com/pages/tags/phpbb.html CVE Daily – phpBB en Wed, 03 Jun 2026 21:26:52 +0000 [High] CVE-2026-29199 – phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to pass... https://nvd.nist.gov/vuln/detail/CVE-2026-29199 https://nvd.nist.gov/vuln/detail/CVE-2026-29199 Mon, 04 May 2026 07:15:59 +0000 High CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can c…

CVSS: 8.1 · CWE: CWE-640

View on NVD

]]> [Medium] CVE-2025-70811 – Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local ... https://nvd.nist.gov/vuln/detail/CVE-2025-70811 https://nvd.nist.gov/vuln/detail/CVE-2025-70811 Thu, 09 Apr 2026 15:16:09 +0000 Medium CVE-2025-70811

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [High] CVE-2025-70810 – Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local ... https://nvd.nist.gov/vuln/detail/CVE-2025-70810 https://nvd.nist.gov/vuln/detail/CVE-2025-70810 Thu, 09 Apr 2026 15:16:09 +0000 High CVE-2025-70810

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2019-25685 – phpBB contains an arbitrary file upload vulnerability that allows authenticated ... https://nvd.nist.gov/vuln/detail/CVE-2019-25685 https://nvd.nist.gov/vuln/detail/CVE-2019-25685 Sun, 05 Apr 2026 21:16:47 +0000 High CVE-2019-25685

phpBB contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by exploiting the plupload functionality and phar:// stream wrapper. Attackers can upload a crafted zip file containing serialized PHP objects that execute arbitrary code when deserialized through the imagick parameter in attachment settings.

CVSS: 8.8 · CWE: CWE-22

View on NVD

]]> [High] CVE-2025-32575 – Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all... https://nvd.nist.gov/vuln/detail/CVE-2025-32575 https://nvd.nist.gov/vuln/detail/CVE-2025-32575 Wed, 09 Apr 2025 17:15:46 +0000 High CVE-2025-32575

Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.

CVSS: 7.1 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2025-32274 – Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all... https://nvd.nist.gov/vuln/detail/CVE-2025-32274 https://nvd.nist.gov/vuln/detail/CVE-2025-32274 Fri, 04 Apr 2025 16:15:38 +0000 Medium CVE-2025-32274

Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [Low] CVE-2023-5917 – A vulnerability, which was classified as problematic, has been found in phpBB up... https://nvd.nist.gov/vuln/detail/CVE-2023-5917 https://nvd.nist.gov/vuln/detail/CVE-2023-5917 Thu, 02 Nov 2023 11:15:14 +0000 Low CVE-2023-5917

A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf…

CVSS: 2.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2020-8226 – A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image ... https://nvd.nist.gov/vuln/detail/CVE-2020-8226 https://nvd.nist.gov/vuln/detail/CVE-2020-8226 Mon, 17 Aug 2020 16:15:13 +0000 Medium CVE-2020-8226

A vulnerability exists in phpBB

CVSS: 5.8 · CWE: CWE-610

View on NVD

]]> [High] CVE-2019-16108 – phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequen... https://nvd.nist.gov/vuln/detail/CVE-2019-16108 https://nvd.nist.gov/vuln/detail/CVE-2019-16108 Fri, 20 Mar 2020 00:17:09 +0000 High CVE-2019-16108

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

CVSS: 7.5 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2019-16107 – Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attach... https://nvd.nist.gov/vuln/detail/CVE-2019-16107 https://nvd.nist.gov/vuln/detail/CVE-2019-16107 Wed, 11 Mar 2020 13:15:11 +0000 Medium CVE-2019-16107

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2020-5502 – phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. https://nvd.nist.gov/vuln/detail/CVE-2020-5502 https://nvd.nist.gov/vuln/detail/CVE-2020-5502 Wed, 15 Jan 2020 00:15:13 +0000 Medium CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

CVSS: 6.5 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2020-5501 – phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. https://nvd.nist.gov/vuln/detail/CVE-2020-5501 https://nvd.nist.gov/vuln/detail/CVE-2020-5501 Wed, 15 Jan 2020 00:15:13 +0000 Medium CVE-2020-5501

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2011-0544 – phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. https://nvd.nist.gov/vuln/detail/CVE-2011-0544 https://nvd.nist.gov/vuln/detail/CVE-2011-0544 Thu, 14 Nov 2019 00:15:10 +0000 Medium CVE-2011-0544

phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [High] CVE-2019-16993 – In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verificatio... https://nvd.nist.gov/vuln/detail/CVE-2019-16993 https://nvd.nist.gov/vuln/detail/CVE-2019-16993 Mon, 30 Sep 2019 12:15:10 +0000 High CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2019-13376 – phpBB version 3.2.7 allows the stealing of an Administration Control Panel sessi... https://nvd.nist.gov/vuln/detail/CVE-2019-13376 https://nvd.nist.gov/vuln/detail/CVE-2019-13376 Fri, 27 Sep 2019 13:15:10 +0000 Medium CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

CVSS: 6.5 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2019-11767 – Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the... https://nvd.nist.gov/vuln/detail/CVE-2019-11767 https://nvd.nist.gov/vuln/detail/CVE-2019-11767 Sun, 05 May 2019 06:29:00 +0000 Medium CVE-2019-11767

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

CVSS: 5.8 · CWE: CWE-918

View on NVD

]]> [High] CVE-2019-9826 – The fulltext search component in phpBB before 3.2.6 allows Denial of Service. https://nvd.nist.gov/vuln/detail/CVE-2019-9826 https://nvd.nist.gov/vuln/detail/CVE-2019-9826 Thu, 02 May 2019 21:29:00 +0000 High CVE-2019-9826

The fulltext search component in phpBB before 3.2.6 allows Denial of Service.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2018-19274 – Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Rem... https://nvd.nist.gov/vuln/detail/CVE-2018-19274 https://nvd.nist.gov/vuln/detail/CVE-2018-19274 Sat, 17 Nov 2018 13:29:00 +0000 High CVE-2018-19274

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

CVSS: 7.2 · CWE: CWE-502

View on NVD

]]> [High] CVE-2017-1000419 – phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resultin... https://nvd.nist.gov/vuln/detail/CVE-2017-1000419 https://nvd.nist.gov/vuln/detail/CVE-2017-1000419 Tue, 02 Jan 2018 19:29:00 +0000 High CVE-2017-1000419

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.

CVSS: 7.5 · CWE: CWE-918

View on NVD

]]> [Medium] CVE-2015-3880 – Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows... https://nvd.nist.gov/vuln/detail/CVE-2015-3880 https://nvd.nist.gov/vuln/detail/CVE-2015-3880 Tue, 19 Sep 2017 15:29:00 +0000 Medium CVE-2015-3880

Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.

CVSS: 6.1 · CWE: CWE-601

View on NVD

]]> [Medium] CVE-2015-1432 – The message_options function in includes/ucp/ucp_pm_options.php in phpBB before ... https://nvd.nist.gov/vuln/detail/CVE-2015-1432 https://nvd.nist.gov/vuln/detail/CVE-2015-1432 Tue, 10 Feb 2015 17:59:01 +0000 Medium CVE-2015-1432

The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

CVSS: 6.8 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2015-1431 – Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before... https://nvd.nist.gov/vuln/detail/CVE-2015-1431 https://nvd.nist.gov/vuln/detail/CVE-2015-1431 Tue, 10 Feb 2015 17:59:00 +0000 Medium CVE-2015-1431

Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."

CVSS: 4.3 · CWE: CWE-79

View on NVD

]]> [High] CVE-2010-1630 – Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impac... https://nvd.nist.gov/vuln/detail/CVE-2010-1630 https://nvd.nist.gov/vuln/detail/CVE-2010-1630 Wed, 19 May 2010 22:30:01 +0000 High CVE-2010-1630

Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Medium] CVE-2010-1627 – feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for... https://nvd.nist.gov/vuln/detail/CVE-2010-1627 https://nvd.nist.gov/vuln/detail/CVE-2010-1627 Wed, 19 May 2010 22:30:00 +0000 Medium CVE-2010-1627

feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum.

CVSS: 4.3 · CWE: CWE-264

View on NVD

]]> [Medium] CVE-2009-3052 – SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime ... https://nvd.nist.gov/vuln/detail/CVE-2009-3052 https://nvd.nist.gov/vuln/detail/CVE-2009-3052 Thu, 03 Sep 2009 17:30:08 +0000 Medium CVE-2009-3052

SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.

CVSS: 6.5 · CWE: CWE-89

View on NVD

]]> [Medium] CVE-2008-7143 – phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderato... https://nvd.nist.gov/vuln/detail/CVE-2008-7143 https://nvd.nist.gov/vuln/detail/CVE-2008-7143 Tue, 01 Sep 2009 16:30:00 +0000 Medium CVE-2008-7143

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.

CVSS: 6.8 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2008-6507 – Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensi... https://nvd.nist.gov/vuln/detail/CVE-2008-6507 https://nvd.nist.gov/vuln/detail/CVE-2008-6507 Mon, 23 Mar 2009 16:30:01 +0000 Medium CVE-2008-6507

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum.

CVSS: 5.0 · CWE: N/A

View on NVD

]]> [Medium] CVE-2008-6506 – Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass inten... https://nvd.nist.gov/vuln/detail/CVE-2008-6506 https://nvd.nist.gov/vuln/detail/CVE-2008-6506 Mon, 23 Mar 2009 16:30:00 +0000 Medium CVE-2008-6506

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors.

CVSS: 5.0 · CWE: CWE-264

View on NVD

]]> [High] CVE-2008-6377 – PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB... https://nvd.nist.gov/vuln/detail/CVE-2008-6377 https://nvd.nist.gov/vuln/detail/CVE-2008-6377 Mon, 02 Mar 2009 19:30:00 +0000 High CVE-2008-6377

PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.

CVSS: 7.5 · CWE: CWE-94

View on NVD

]]> [High] CVE-2008-6314 – SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and ear... https://nvd.nist.gov/vuln/detail/CVE-2008-6314 https://nvd.nist.gov/vuln/detail/CVE-2008-6314 Fri, 27 Feb 2009 11:30:00 +0000 High CVE-2008-6314

SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [High] CVE-2008-6301 – SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1... https://nvd.nist.gov/vuln/detail/CVE-2008-6301 https://nvd.nist.gov/vuln/detail/CVE-2008-6301 Thu, 26 Feb 2009 16:17:19 +0000 High CVE-2008-6301

SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [High] CVE-2008-5585 – Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 al... https://nvd.nist.gov/vuln/detail/CVE-2008-5585 https://nvd.nist.gov/vuln/detail/CVE-2008-5585 Tue, 16 Dec 2008 19:07:31 +0000 High CVE-2008-5585

Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) portal/includes/portal_block.php and (2) includes/acp/acp_lcxbbportal.php.

CVSS: 7.5 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2008-4125 – The search function in phpBB 2.x provides a search_id value that leaks the state... https://nvd.nist.gov/vuln/detail/CVE-2008-4125 https://nvd.nist.gov/vuln/detail/CVE-2008-4125 Thu, 18 Sep 2008 17:59:33 +0000 Medium CVE-2008-4125

The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as demonstrated by a cross-application attack against WordPress, a different vulnerability than CVE-2006-0632.

CVSS: 5.0 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2008-3315 – Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10 allow re... https://nvd.nist.gov/vuln/detail/CVE-2008-3315 https://nvd.nist.gov/vuln/detail/CVE-2008-3315 Fri, 25 Jul 2008 16:41:00 +0000 Medium CVE-2008-3315

Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the (1) query string to (a) announcements/messages.php; (b) lostPassword.php and (c) profile.php in auth/; (d) calendar/myagenda.php; (e) group/group.php; (f) learningPath.php, (g) learningPathList.php, and (h) module.php in learnPath/; (i) phpbb/index.php; (j)…

CVSS: 4.3 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2008-3260 – Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 a... https://nvd.nist.gov/vuln/detail/CVE-2008-3260 https://nvd.nist.gov/vuln/detail/CVE-2008-3260 Tue, 22 Jul 2008 17:41:00 +0000 Medium CVE-2008-3260

Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exer…

CVSS: 4.3 · CWE: CWE-79

View on NVD

]]> [Critical] CVE-2008-3224 – Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack ve... https://nvd.nist.gov/vuln/detail/CVE-2008-3224 https://nvd.nist.gov/vuln/detail/CVE-2008-3224 Fri, 18 Jul 2008 16:41:00 +0000 Critical CVE-2008-3224

Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()."

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Critical] CVE-2008-2481 – PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.function... https://nvd.nist.gov/vuln/detail/CVE-2008-2481 https://nvd.nist.gov/vuln/detail/CVE-2008-2481 Wed, 28 May 2008 15:32:00 +0000 Critical CVE-2008-2481

PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pConfig_auth[phpbb_path] parameter.

CVSS: 10.0 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2008-1766 – Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact a... https://nvd.nist.gov/vuln/detail/CVE-2008-1766 https://nvd.nist.gov/vuln/detail/CVE-2008-1766 Sat, 12 Apr 2008 20:05:00 +0000 Critical CVE-2008-1766

Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [High] CVE-2008-1565 – Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module f... https://nvd.nist.gov/vuln/detail/CVE-2008-1565 https://nvd.nist.gov/vuln/detail/CVE-2008-1565 Mon, 31 Mar 2008 22:44:00 +0000 High CVE-2008-1565

Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.

CVSS: 7.5 · CWE: CWE-22

View on NVD

]]> [High] CVE-2008-1512 – Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module... https://nvd.nist.gov/vuln/detail/CVE-2008-1512 https://nvd.nist.gov/vuln/detail/CVE-2008-1512 Tue, 25 Mar 2008 23:44:00 +0000 High CVE-2008-1512

Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party information.

CVSS: 7.5 · CWE: CWE-22

View on NVD

]]> [High] CVE-2008-1350 – SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allo... https://nvd.nist.gov/vuln/detail/CVE-2008-1350 https://nvd.nist.gov/vuln/detail/CVE-2008-1350 Mon, 17 Mar 2008 16:44:00 +0000 High CVE-2008-1350

SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allows remote attackers to execute arbitrary SQL commands via the k parameter in an article action.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [High] CVE-2008-1305 – SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows... https://nvd.nist.gov/vuln/detail/CVE-2008-1305 https://nvd.nist.gov/vuln/detail/CVE-2008-1305 Wed, 12 Mar 2008 17:44:00 +0000 High CVE-2008-1305

SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Medium] CVE-2008-1171 – Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module ... https://nvd.nist.gov/vuln/detail/CVE-2008-1171 https://nvd.nist.gov/vuln/detail/CVE-2008-1171 Wed, 05 Mar 2008 23:44:00 +0000 Medium CVE-2008-1171

Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) 123flashchat.php and (2) phpbb_login_chat.php. NOTE: CVE disputes this issue because $phpbb_root_path is explicitly set to "./" in both programs

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2008-0471 – Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 a... https://nvd.nist.gov/vuln/detail/CVE-2008-0471 https://nvd.nist.gov/vuln/detail/CVE-2008-0471 Tue, 29 Jan 2008 20:00:00 +0000 Medium CVE-2008-0471

Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [High] CVE-2007-6223 – SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows rem... https://nvd.nist.gov/vuln/detail/CVE-2007-6223 https://nvd.nist.gov/vuln/detail/CVE-2007-6223 Tue, 04 Dec 2007 17:46:00 +0000 High CVE-2007-6223

SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a search action in browse mode.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2007-6088 – PHP remote file inclusion vulnerability in includes/functions_mod_user.php in ph... https://nvd.nist.gov/vuln/detail/CVE-2007-6088 https://nvd.nist.gov/vuln/detail/CVE-2007-6088 Thu, 22 Nov 2007 00:46:00 +0000 Critical CVE-2007-6088

PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBBViet 02.03.07 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 9.3 · CWE: CWE-94

View on NVD

]]> [High] CVE-2007-5688 – Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka... https://nvd.nist.gov/vuln/detail/CVE-2007-5688 https://nvd.nist.gov/vuln/detail/CVE-2007-5688 Mon, 29 Oct 2007 19:46:00 +0000 High CVE-2007-5688

Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Medium] CVE-2007-5173 – PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.p... https://nvd.nist.gov/vuln/detail/CVE-2007-5173 https://nvd.nist.gov/vuln/detail/CVE-2007-5173 Wed, 03 Oct 2007 14:17:00 +0000 Medium CVE-2007-5173

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-5178 – contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a crit... https://nvd.nist.gov/vuln/detail/CVE-2007-5178 https://nvd.nist.gov/vuln/detail/CVE-2007-5178 Wed, 03 Oct 2007 14:17:00 +0000 Medium CVE-2007-5178

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-5164 – PHP remote file inclusion vulnerability in htmls/forum/includes/topic_review.php... https://nvd.nist.gov/vuln/detail/CVE-2007-5164 https://nvd.nist.gov/vuln/detail/CVE-2007-5164 Mon, 01 Oct 2007 05:17:00 +0000 Medium CVE-2007-5164

PHP remote file inclusion vulnerability in htmls/forum/includes/topic_review.php in UniversiBO 1.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct request

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-5140 – PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in... https://nvd.nist.gov/vuln/detail/CVE-2007-5140 https://nvd.nist.gov/vuln/detail/CVE-2007-5140 Fri, 28 Sep 2007 21:17:00 +0000 Medium CVE-2007-5140

PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-5100 – Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a... https://nvd.nist.gov/vuln/detail/CVE-2007-5100 https://nvd.nist.gov/vuln/detail/CVE-2007-5100 Wed, 26 Sep 2007 22:17:00 +0000 Medium CVE-2007-5100

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) language/lang_german/lang_admin_album.php, (2) language/lang_english/lang_main_album.php, and (3) language/lang_english/lang_admin_album.php, different vectors than…

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-5033 – Cross-site scripting (XSS) vulnerability in profile.php in phpBB XS 2 allows rem... https://nvd.nist.gov/vuln/detail/CVE-2007-5033 https://nvd.nist.gov/vuln/detail/CVE-2007-5033 Fri, 21 Sep 2007 19:17:00 +0000 Medium CVE-2007-5033

Cross-site scripting (XSS) vulnerability in profile.php in phpBB XS 2 allows remote attackers to inject arbitrary web script or HTML via the selfdes parameter in a profile_info editprofile action.

CVSS: 4.3 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2007-5009 – PHP remote file inclusion vulnerability in language/lang_german/lang_main_album... https://nvd.nist.gov/vuln/detail/CVE-2007-5009 https://nvd.nist.gov/vuln/detail/CVE-2007-5009 Thu, 20 Sep 2007 21:17:00 +0000 Medium CVE-2007-5009

PHP remote file inclusion vulnerability in language/lang_german/lang_main_album.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [High] CVE-2007-4984 – SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for p... https://nvd.nist.gov/vuln/detail/CVE-2007-4984 https://nvd.nist.gov/vuln/detail/CVE-2007-4984 Wed, 19 Sep 2007 19:17:00 +0000 High CVE-2007-4984

SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [High] CVE-2007-4653 – SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for ... https://nvd.nist.gov/vuln/detail/CVE-2007-4653 https://nvd.nist.gov/vuln/detail/CVE-2007-4653 Tue, 04 Sep 2007 22:17:00 +0000 High CVE-2007-4653

SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter in a search action.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2007-3935 – PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 mo... https://nvd.nist.gov/vuln/detail/CVE-2007-3935 https://nvd.nist.gov/vuln/detail/CVE-2007-3935 Sat, 21 Jul 2007 00:30:00 +0000 Critical CVE-2007-3935

PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 9.3 · CWE: N/A

View on NVD

]]> [High] CVE-2007-3697 – PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 an... https://nvd.nist.gov/vuln/detail/CVE-2007-3697 https://nvd.nist.gov/vuln/detail/CVE-2007-3697 Wed, 11 Jul 2007 22:30:00 +0000 High CVE-2007-3697

PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-7208 – PHP remote file inclusion vulnerability in download.php in the Adam van Dongen F... https://nvd.nist.gov/vuln/detail/CVE-2006-7208 https://nvd.nist.gov/vuln/detail/CVE-2006-7208 Tue, 26 Jun 2007 23:30:00 +0000 Medium CVE-2006-7208

PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: CWE-20

View on NVD

]]> [Medium] CVE-2007-2858 – SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mo... https://nvd.nist.gov/vuln/detail/CVE-2007-2858 https://nvd.nist.gov/vuln/detail/CVE-2007-2858 Thu, 24 May 2007 19:30:00 +0000 Medium CVE-2007-2858

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field.

CVSS: 6.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-2257 – PHP remote file inclusion vulnerability in subscp.php in Fully Modded phpBB2 all... https://nvd.nist.gov/vuln/detail/CVE-2007-2257 https://nvd.nist.gov/vuln/detail/CVE-2007-2257 Wed, 25 Apr 2007 17:19:00 +0000 High CVE-2007-2257

PHP remote file inclusion vulnerability in subscp.php in Fully Modded phpBB2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-2208 – Multiple PHP remote file inclusion vulnerabilities in Extreme PHPBB2 3.0 Pre Fin... https://nvd.nist.gov/vuln/detail/CVE-2007-2208 https://nvd.nist.gov/vuln/detail/CVE-2007-2208 Tue, 24 Apr 2007 20:19:00 +0000 High CVE-2007-2208

Multiple PHP remote file inclusion vulnerabilities in Extreme PHPBB2 3.0 Pre Final allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions.php or (2) functions_portal.php in includes/.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Medium] CVE-2007-2189 – PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX S... https://nvd.nist.gov/vuln/detail/CVE-2007-2189 https://nvd.nist.gov/vuln/detail/CVE-2007-2189 Tue, 24 Apr 2007 17:19:00 +0000 Medium CVE-2007-2189

PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: N/A

View on NVD

]]> [High] CVE-2007-1961 – PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0... https://nvd.nist.gov/vuln/detail/CVE-2007-1961 https://nvd.nist.gov/vuln/detail/CVE-2007-1961 Wed, 11 Apr 2007 10:19:00 +0000 High CVE-2007-1961

PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-1839 – Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier a... https://nvd.nist.gov/vuln/detail/CVE-2007-1839 https://nvd.nist.gov/vuln/detail/CVE-2007-1839 Tue, 03 Apr 2007 00:19:00 +0000 High CVE-2007-1839

Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) pass_code.php or (2) lang_select.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-1818 – PHP remote file inclusion vulnerability in MOD_forum_fields_parse.php in the For... https://nvd.nist.gov/vuln/detail/CVE-2007-1818 https://nvd.nist.gov/vuln/detail/CVE-2007-1818 Mon, 02 Apr 2007 23:19:00 +0000 High CVE-2007-1818

PHP remote file inclusion vulnerability in MOD_forum_fields_parse.php in the Forum picture and META tags 1.7 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2007-1778 – PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-... https://nvd.nist.gov/vuln/detail/CVE-2007-1778 https://nvd.nist.gov/vuln/detail/CVE-2007-1778 Fri, 30 Mar 2007 01:19:00 +0000 Critical CVE-2007-1778

PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-Forums) module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Critical] CVE-2007-1695 – PHP remote file inclusion vulnerability in includes/usercp_register.php in phpBB... https://nvd.nist.gov/vuln/detail/CVE-2007-1695 https://nvd.nist.gov/vuln/detail/CVE-2007-1695 Tue, 27 Mar 2007 01:19:00 +0000 Critical CVE-2007-1695

PHP remote file inclusion vulnerability in includes/usercp_register.php in phpBB 2.0.19 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: this issue has been disputed by third-party researchers, stating that the file checks for a global constant and cannot be accessed directly

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Critical] CVE-2006-7174 – PHP remote file inclusion vulnerability in includes/functions.php in the Dimensi... https://nvd.nist.gov/vuln/detail/CVE-2006-7174 https://nvd.nist.gov/vuln/detail/CVE-2006-7174 Wed, 21 Mar 2007 21:19:00 +0000 Critical CVE-2006-7174

PHP remote file inclusion vulnerability in includes/functions.php in the Dimension module of phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: this may be the same issue as CVE-2006-5235.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [High] CVE-2007-1555 – SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a an... https://nvd.nist.gov/vuln/detail/CVE-2007-1555 https://nvd.nist.gov/vuln/detail/CVE-2007-1555 Tue, 20 Mar 2007 22:19:00 +0000 High CVE-2007-1555

SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the c parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2006-7168 – PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name ... https://nvd.nist.gov/vuln/detail/CVE-2006-7168 https://nvd.nist.gov/vuln/detail/CVE-2006-7168 Tue, 20 Mar 2007 10:19:00 +0000 High CVE-2006-7168

PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2007-1421 – Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remo... https://nvd.nist.gov/vuln/detail/CVE-2007-1421 https://nvd.nist.gov/vuln/detail/CVE-2007-1421 Tue, 13 Mar 2007 01:19:00 +0000 Critical CVE-2007-1421

Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions_kb.php, (2) themen_portal_mitte.php, or (3) logger_engine.php in includes/.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-7147 – PHP remote file inclusion vulnerability in includes/functions_mod_user.php in ph... https://nvd.nist.gov/vuln/detail/CVE-2006-7147 https://nvd.nist.gov/vuln/detail/CVE-2006-7147 Wed, 07 Mar 2007 20:19:00 +0000 Medium CVE-2006-7147

PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2006-7148 – PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluin... https://nvd.nist.gov/vuln/detail/CVE-2006-7148 https://nvd.nist.gov/vuln/detail/CVE-2006-7148 Wed, 07 Mar 2007 20:19:00 +0000 Critical CVE-2006-7148

PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. NOTE: this might be the same issues as CVE-2006-4893.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-7100 – PHP remote file inclusion vulnerability in includes/functions_mod_user.php in ph... https://nvd.nist.gov/vuln/detail/CVE-2006-7100 https://nvd.nist.gov/vuln/detail/CVE-2006-7100 Sat, 03 Mar 2007 21:19:00 +0000 Medium CVE-2006-7100

PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2006-7076 – Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook ... https://nvd.nist.gov/vuln/detail/CVE-2006-7076 https://nvd.nist.gov/vuln/detail/CVE-2006-7076 Fri, 02 Mar 2007 21:18:00 +0000 Medium CVE-2006-7076

Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter. NOTE: this issue might be resultant from SQL injection.

CVSS: 4.3 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-7077 – SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB... https://nvd.nist.gov/vuln/detail/CVE-2006-7077 https://nvd.nist.gov/vuln/detail/CVE-2006-7077 Fri, 02 Mar 2007 21:18:00 +0000 Medium CVE-2006-7077

SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter.

CVSS: 6.8 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-7090 – PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security ... https://nvd.nist.gov/vuln/detail/CVE-2006-7090 https://nvd.nist.gov/vuln/detail/CVE-2006-7090 Fri, 02 Mar 2007 21:18:00 +0000 Medium CVE-2006-7090

PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the php_root_path parameter.

CVSS: 6.8 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2007-1105 – PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka p... https://nvd.nist.gov/vuln/detail/CVE-2007-1105 https://nvd.nist.gov/vuln/detail/CVE-2007-1105 Mon, 26 Feb 2007 17:28:00 +0000 Medium CVE-2007-1105

PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 5.0 · CWE: N/A

View on NVD

]]> [Medium] CVE-2007-1106 – PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.ph... https://nvd.nist.gov/vuln/detail/CVE-2007-1106 https://nvd.nist.gov/vuln/detail/CVE-2007-1106 Mon, 26 Feb 2007 17:28:00 +0000 Medium CVE-2007-1106

PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 · CWE: N/A

View on NVD

]]> [Critical] CVE-2006-7032 – PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and... https://nvd.nist.gov/vuln/detail/CVE-2006-7032 https://nvd.nist.gov/vuln/detail/CVE-2006-7032 Fri, 23 Feb 2007 03:28:00 +0000 Critical CVE-2006-7032

PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path parameter.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [High] CVE-2007-1048 – PHP remote file inclusion vulnerability in admin_rebuild_search.php in phpbb_wor... https://nvd.nist.gov/vuln/detail/CVE-2007-1048 https://nvd.nist.gov/vuln/detail/CVE-2007-1048 Wed, 21 Feb 2007 17:28:00 +0000 High CVE-2007-1048

PHP remote file inclusion vulnerability in admin_rebuild_search.php in phpbb_wordsearch allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Medium] CVE-2006-2219 – phpBB 2.0.20 does not verify user-specified input variable types before being pa... https://nvd.nist.gov/vuln/detail/CVE-2006-2219 https://nvd.nist.gov/vuln/detail/CVE-2006-2219 Thu, 08 Feb 2007 17:28:00 +0000 Medium CVE-2006-2219

phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the (1) mode parameter to memberlist.php and the (2) highlight parameter to viewtopic.php that are used as an argument to the htmlspecialchars or urlencode functions, which displays the installation path…

CVSS: 5.0 · CWE: CWE-20

View on NVD

]]> [Medium] CVE-2006-2220 – phpBB 2.0.20 does not properly verify user-specified input variables used as lim... https://nvd.nist.gov/vuln/detail/CVE-2006-2220 https://nvd.nist.gov/vuln/detail/CVE-2006-2220 Thu, 08 Feb 2007 17:28:00 +0000 Medium CVE-2006-2220

phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive information via a negative LIMIT specification, as demonstrated by the start parameter to memberlist.php, which reveals the SQL query in the resulting error message.

CVSS: 5.0 · CWE: CWE-20

View on NVD

]]> [High] CVE-2007-0809 – PHP remote file inclusion vulnerability in includes/class_template.php in Catego... https://nvd.nist.gov/vuln/detail/CVE-2007-0809 https://nvd.nist.gov/vuln/detail/CVE-2007-0809 Wed, 07 Feb 2007 11:28:00 +0000 High CVE-2007-0809

PHP remote file inclusion vulnerability in includes/class_template.php in Categories hierarchy (aka CH or mod-CH) 2.1.2 in ptirhiikmods allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0761 – PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter... https://nvd.nist.gov/vuln/detail/CVE-2007-0761 https://nvd.nist.gov/vuln/detail/CVE-2007-0761 Tue, 06 Feb 2007 02:28:00 +0000 High CVE-2007-0761

PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the ezconvert_dir parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0762 – PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Bui... https://nvd.nist.gov/vuln/detail/CVE-2007-0762 https://nvd.nist.gov/vuln/detail/CVE-2007-0762 Tue, 06 Feb 2007 02:28:00 +0000 High CVE-2007-0762

PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0680 – PHP remote file inclusion vulnerability in includes/functions.php in Phpbb Tweak... https://nvd.nist.gov/vuln/detail/CVE-2007-0680 https://nvd.nist.gov/vuln/detail/CVE-2007-0680 Sat, 03 Feb 2007 01:28:00 +0000 High CVE-2007-0680

PHP remote file inclusion vulnerability in includes/functions.php in Phpbb Tweaked 3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0683 – PHP remote file inclusion vulnerability in includes/functions.php in Omegaboard ... https://nvd.nist.gov/vuln/detail/CVE-2007-0683 https://nvd.nist.gov/vuln/detail/CVE-2007-0683 Sat, 03 Feb 2007 01:28:00 +0000 High CVE-2007-0683

PHP remote file inclusion vulnerability in includes/functions.php in Omegaboard 1.0beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2007-0684 – PHP remote file inclusion vulnerability in portal.php in Cerulean Portal System ... https://nvd.nist.gov/vuln/detail/CVE-2007-0684 https://nvd.nist.gov/vuln/detail/CVE-2007-0684 Sat, 03 Feb 2007 01:28:00 +0000 High CVE-2007-0684

PHP remote file inclusion vulnerability in portal.php in Cerulean Portal System 0.7b allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0656 – PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODi... https://nvd.nist.gov/vuln/detail/CVE-2007-0656 https://nvd.nist.gov/vuln/detail/CVE-2007-0656 Thu, 01 Feb 2007 22:28:00 +0000 High CVE-2007-0656

PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0662 – PHP remote file inclusion vulnerability in includes/usercp_viewprofile.php in Ha... https://nvd.nist.gov/vuln/detail/CVE-2007-0662 https://nvd.nist.gov/vuln/detail/CVE-2007-0662 Thu, 01 Feb 2007 22:28:00 +0000 High CVE-2007-0662

PHP remote file inclusion vulnerability in includes/usercp_viewprofile.php in Hailboards 1.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0591 – PHP remote file inclusion vulnerability in configure.php in Vu Le An Virtual Pat... https://nvd.nist.gov/vuln/detail/CVE-2007-0591 https://nvd.nist.gov/vuln/detail/CVE-2007-0591 Tue, 30 Jan 2007 18:28:00 +0000 High CVE-2007-0591

PHP remote file inclusion vulnerability in configure.php in Vu Le An Virtual Path (VirtualPath) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0572 – PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Gol... https://nvd.nist.gov/vuln/detail/CVE-2007-0572 https://nvd.nist.gov/vuln/detail/CVE-2007-0572 Tue, 30 Jan 2007 17:28:00 +0000 High CVE-2007-0572

PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Golem Gaming Portal 0.5.1 Alpha 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0581 – PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite... https://nvd.nist.gov/vuln/detail/CVE-2007-0581 https://nvd.nist.gov/vuln/detail/CVE-2007-0581 Tue, 30 Jan 2007 17:28:00 +0000 High CVE-2007-0581

PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2007-0561 – Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remo... https://nvd.nist.gov/vuln/detail/CVE-2007-0561 https://nvd.nist.gov/vuln/detail/CVE-2007-0561 Tue, 30 Jan 2007 16:28:00 +0000 High CVE-2007-0561

Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) admin_linkdb.php, (2) admin_forum_prune.php, (3) admin_extensions.php, (4) admin_board.php, (5) admin_attachments.php, or (6) admin_users.php in admin/.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2006-6839 – Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote a... https://nvd.nist.gov/vuln/detail/CVE-2006-6839 https://nvd.nist.gov/vuln/detail/CVE-2006-6839 Sun, 31 Dec 2006 05:00:00 +0000 Critical CVE-2006-6839

Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to "criteria for 'bad' redirection targets."

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Critical] CVE-2006-6840 – Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote a... https://nvd.nist.gov/vuln/detail/CVE-2006-6840 https://nvd.nist.gov/vuln/detail/CVE-2006-6840 Sun, 31 Dec 2006 05:00:00 +0000 Critical CVE-2006-6840

Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to a "negative start parameter."

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Critical] CVE-2006-6841 – Certain forms in phpBB before 2.0.22 lack session checks, which has unknown impa... https://nvd.nist.gov/vuln/detail/CVE-2006-6841 https://nvd.nist.gov/vuln/detail/CVE-2006-6841 Sun, 31 Dec 2006 05:00:00 +0000 Critical CVE-2006-6841

Certain forms in phpBB before 2.0.22 lack session checks, which has unknown impact and remote attack vectors.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [High] CVE-2006-6789 – PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in... https://nvd.nist.gov/vuln/detail/CVE-2006-6789 https://nvd.nist.gov/vuln/detail/CVE-2006-6789 Thu, 28 Dec 2006 00:28:00 +0000 High CVE-2006-6789

PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Phpbbxtra 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5 · CWE: N/A

View on NVD

]]>