phpBB
by PhpBB
Source repositories
CVEs (129)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-48611 | Cri | 0.64 | 9.8 | 0.04 | Jun 12, 2026 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations. | ||
| CVE-2001-1471 | Hig | 0.61 | 8.8 | 0.08 | Jul 31, 2001 | prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified… | ||
| CVE-2025-70810 | Hig | 0.57 | 8.8 | 0.00 | Apr 9, 2026 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism | ||
| CVE-2019-16993 | Hig | 0.50 | 8.8 | 0.01 | Sep 30, 2019 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator… | ||
| CVE-2019-16108 | Hig | 0.49 | 7.5 | 0.01 | Mar 20, 2020 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. | ||
| CVE-2019-9826 | Hig | 0.49 | 7.5 | 0.02 | May 2, 2019 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service. | ||
| CVE-2017-1000419 | Hig | 0.49 | 7.5 | 0.01 | Jan 2, 2018 | phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application. | ||
| CVE-2026-47366 | Hig | 0.47 | 7.2 | 0.00 | Jun 12, 2026 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the… | ||
| CVE-2018-19274 | Hig | 0.47 | 7.2 | 0.05 | Nov 17, 2018 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions. | ||
| CVE-2026-29199 | Hig | 0.46 | 8.1 | 0.00 | May 4, 2026 | phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who… | ||
| CVE-2020-5502 | Med | 0.42 | 6.5 | 0.00 | Jan 15, 2020 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. | ||
| CVE-2019-13376 | Med | 0.42 | 6.5 | 0.01 | Sep 27, 2019 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS | ||
| CVE-2011-0544 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2019 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. | ||
| CVE-2019-11767 | Med | 0.38 | 5.8 | 0.01 | May 5, 2019 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function. | ||
| CVE-2015-3880 | Med | 0.33 | 6.1 | 0.02 | Sep 19, 2017 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors. | ||
| CVE-2026-48613 | Med | 0.31 | 5.9 | 0.00 | Jun 12, 2026 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have… | ||
| CVE-2020-8226 | Med | 0.31 | 5.8 | 0.01 | Aug 17, 2020 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. | ||
| CVE-2025-70811 | Med | 0.28 | 4.3 | 0.00 | Apr 9, 2026 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality. | ||
| CVE-2019-16107 | Med | 0.28 | 4.3 | 0.00 | Mar 11, 2020 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. | ||
| CVE-2020-5501 | Med | 0.28 | 4.3 | 0.00 | Jan 15, 2020 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. |
- risk 0.64cvss 9.8epss 0.04
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.
- risk 0.61cvss 8.8epss 0.08
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified…
- risk 0.57cvss 8.8epss 0.00
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism
- risk 0.50cvss 8.8epss 0.01
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator…
- risk 0.49cvss 7.5epss 0.01
phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
- risk 0.49cvss 7.5epss 0.02
The fulltext search component in phpBB before 3.2.6 allows Denial of Service.
- risk 0.49cvss 7.5epss 0.01
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
- risk 0.47cvss 7.2epss 0.00
Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the…
- risk 0.47cvss 7.2epss 0.05
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
- risk 0.46cvss 8.1epss 0.00
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who…
- risk 0.42cvss 6.5epss 0.00
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
- risk 0.42cvss 6.5epss 0.01
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
- risk 0.40cvss 6.1epss 0.01
phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.
- risk 0.38cvss 5.8epss 0.01
Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.
- risk 0.33cvss 6.1epss 0.02
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- risk 0.31cvss 5.9epss 0.00
SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have…
- risk 0.31cvss 5.8epss 0.01
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
- risk 0.28cvss 4.3epss 0.00
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.
- risk 0.28cvss 4.3epss 0.00
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
- risk 0.28cvss 4.3epss 0.00
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
Page 1 of 7