Phorum
by Phorum
Source repositories
CVEs (58)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2000-1228 | 0.03 | — | 0.02 | Dec 31, 2000 | Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables. | |||
| CVE-2003-1487 | 0.01 | — | 0.08 | Dec 31, 2003 | Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program. | |||
| CVE-2011-3622 | 0.00 | — | 0.01 | Jan 22, 2020 | A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18. | |||
| CVE-2012-6659 | 0.00 | — | 0.01 | Sep 19, 2014 | Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. | |||
| CVE-2011-3768 | 0.00 | — | 0.01 | Sep 24, 2011 | Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files. | |||
| CVE-2011-3392 | 0.00 | — | 0.01 | Sep 8, 2011 | Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter. | |||
| CVE-2011-3382 | 0.00 | — | 0.01 | Sep 8, 2011 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2011-3381 | 0.00 | — | 0.01 | Sep 8, 2011 | Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||
| CVE-2010-1629 | 0.00 | — | 0.01 | May 19, 2010 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address. | |||
| CVE-2009-0488 | 0.00 | — | 0.01 | Feb 9, 2009 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2008-4513 | 0.00 | — | 0.02 | Oct 9, 2008 | Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags. | |||
| CVE-2008-1486 | 0.00 | — | 0.01 | Mar 24, 2008 | SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search. | |||
| CVE-2006-6968 | 0.00 | — | 0.01 | Feb 6, 2007 | Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2007-0767 | 0.00 | — | 0.01 | Feb 6, 2007 | Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2007-0769 | 0.00 | — | 0.01 | Feb 6, 2007 | Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly. | |||
| CVE-2006-3615 | 0.00 | — | 0.02 | Jul 18, 2006 | Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable. | |||
| CVE-2006-3612 | 0.00 | — | 0.01 | Jul 18, 2006 | Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2006-3249 | 0.00 | — | 0.01 | Jun 27, 2006 | SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter… | |||
| CVE-2005-3543 | 0.00 | — | 0.01 | Nov 16, 2005 | SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter. | |||
| CVE-2005-2836 | 0.00 | — | 0.01 | Sep 7, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly… |
- CVE-2000-1228Dec 31, 2000risk 0.03cvss —epss 0.02
Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables.
- CVE-2003-1487Dec 31, 2003risk 0.01cvss —epss 0.08
Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.
- CVE-2011-3622Jan 22, 2020risk 0.00cvss —epss 0.01
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
- CVE-2012-6659Sep 19, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
- CVE-2011-3768Sep 24, 2011risk 0.00cvss —epss 0.01
Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files.
- CVE-2011-3392Sep 8, 2011risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.
- CVE-2011-3382Sep 8, 2011risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2011-3381Sep 8, 2011risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- CVE-2010-1629May 19, 2010risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.
- CVE-2009-0488Feb 9, 2009risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2008-4513Oct 9, 2008risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags.
- CVE-2008-1486Mar 24, 2008risk 0.00cvss —epss 0.01
SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.
- CVE-2006-6968Feb 6, 2007risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2007-0767Feb 6, 2007risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2007-0769Feb 6, 2007risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly.
- CVE-2006-3615Jul 18, 2006risk 0.00cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
- CVE-2006-3612Jul 18, 2006risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2006-3249Jun 27, 2006risk 0.00cvss —epss 0.01
SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter…
- CVE-2005-3543Nov 16, 2005risk 0.00cvss —epss 0.01
SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
- CVE-2005-2836Sep 7, 2005risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly…
Page 2 of 3