Ultimate PHP Board
by Myupb
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-61540 | Med | 0.42 | 6.5 | 0.00 | Oct 16, 2025 | SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. | ||
| CVE-2025-61539 | Med | 0.40 | 6.1 | 0.00 | Oct 16, 2025 | Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php. | ||
| CVE-2003-0395 | 0.03 | — | 0.03 | Jul 2, 2003 | Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes admin_iplog.php. | |||
| CVE-2015-2217 | 0.00 | — | 0.02 | Mar 10, 2015 | Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php. |
- risk 0.42cvss 6.5epss 0.00
SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.
- risk 0.40cvss 6.1epss 0.00
Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.
- CVE-2003-0395Jul 2, 2003risk 0.03cvss —epss 0.03
Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes admin_iplog.php.
- CVE-2015-2217Mar 10, 2015risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.