VYPR
← PhpBB

Vendor CVEs

PhpBB

All CVEs

356 total · sorted by risk
  • CVE-2007-1555Mar 20, 2007
    Minerva
    Minerva
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the c parameter.

  • CVE-2006-7148Mar 7, 2007
    PhpBB
    Maluinfo
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. NOTE: this might be the same issues as CVE-2006-4893.

  • CVE-2006-7147Mar 7, 2007
    PhpBB
    Import Tools
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-7100Mar 3, 2007
    PhpBB
    Insert User
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-1106Feb 26, 2007
    Nomoketos Rules
    Nomoketos Rules
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-0809Feb 7, 2007
    PhpBB
    Categories Hierarchy (aka CH or mod-CH)
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/class_template.php in Categories hierarchy (aka CH or mod-CH) 2.1.2 in ptirhiikmods allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-0761Feb 6, 2007
    PhpBB
    Ezboard Converter
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the ezconvert_dir parameter.

  • CVE-2007-0762Feb 6, 2007
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-6593Dec 15, 2006
    PhpBB
    Amazonia Mod
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in zufallscodepart.php in AMAZONIA MOD for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5665Nov 3, 2006
    Spider Friendly
    Spider Friendly
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5418Oct 20, 2006
    PhpBB
    Searchindexer
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5415Oct 20, 2006
    News Defilante Horizontale
    News Defilante Horizontale
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_newshr.php in the News Defilante Horizontale 4.1.1 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5390Oct 18, 2006
    PhpBB
    Acp User Registration Module
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_mod_user.php in the ACP User Registration (MMW) 1.00 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5309Oct 17, 2006
    PhpBB
    Prillian French
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5312Oct 17, 2006
    PhpBB
    Ajax Shoutbox
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5301Oct 17, 2006
    PhpBB
    Spamblockermod
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5306Oct 17, 2006
    PhpBB
    Journals System Module
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/journals_delete.php, (2) includes/journals_post.php,…

  • CVE-2006-5305Oct 17, 2006
    PhpBB
    Lat2cyr
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5222Oct 10, 2006
    Dimension Of Phpbb
    Dimension Of Phpbb
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Dimension of phpBB 0.2.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/themen_portal_mitte.php or (2) includes/logger_engine.php.

  • CVE-2006-5191Oct 10, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5209Oct 10, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Admin Topic Action Logging Mod 0.95 and earlier, as used in phpBB 2.0 up to 2.0.21, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5094Sep 29, 2006
    Phpbb Xs
    Phpbb Xs
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_kb.php in the phpBB XS 2 (Spain version) allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780 or CVE-2006-4893.

  • CVE-2006-4779Sep 14, 2006
    PhpBB
    Vitrax Premodded Phpbb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-4449Aug 30, 2006
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.

  • CVE-2006-4450Aug 30, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.04

    usercp_avatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server as a web proxy by submitting a URL to the avatarurl parameter, which is then used in an HTTP GET request.

  • CVE-2006-3940Jul 31, 2006
    PhpBB
    Phpbb Auction
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via (1) the ar parameter in auction_room.php and (2) the u parameter in auction_store.php. NOTE: the auction_rating.php vector is already covered by CVE-2005-1234. …

  • CVE-2006-3775Jul 24, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header ($_SERVER['HTTP_CLIENT_IP'] variable), as utilized by index.php.

  • CVE-2006-2908Jun 13, 2006
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.04

    The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.

  • CVE-2006-2865Jun 6, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page…

  • CVE-2006-2360May 15, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-2359May 15, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this issue might be resultant from SQL injection.

  • CVE-2006-2336May 12, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.

  • CVE-2006-1974Apr 21, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.

  • CVE-2006-1912Apr 20, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site…

  • CVE-2006-0959Mar 2, 2006
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be…

  • CVE-2006-0470Jan 31, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.

  • CVE-2006-0442Jan 26, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are…

  • CVE-2005-3326Oct 27, 2005
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.

  • CVE-2005-2697Aug 26, 2005
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282.

  • CVE-2005-2580Aug 16, 2005
    MyBB
    MyBulletinBoard
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in (1) index.php or (2) member.php, action parameter to (3) search.php or (4) member.php, or (5)…

  • CVE-2005-1833May 31, 2005
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to calendar.php, (2) idsql parameter to online.php, (3) usersearch parameter to memberlist.php, (4) pid parameter to…

  • CVE-2005-1378May 3, 2005
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in posting_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, which is used in the $post_id variable, and other attack vectors.

  • CVE-2005-1196May 2, 2005
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in kb.php in the Knowledge Base module for phpBB allows remote attackers to obtain sensitive information and execute SQL commands via the cat parameter.

  • CVE-2005-1170May 2, 2005
    Datenbank Module
    Datenbank Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-1171May 2, 2005
    Datenbank Module
    Datenbank Module
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2004-2350Dec 31, 2004
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.

  • CVE-2004-1943Apr 19, 2004
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.

  • CVE-2003-1244Dec 31, 2003
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possibly gain unauthorized access to forums via the forum_id parameter to index.php.

  • CVE-2003-1216Nov 27, 2003
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.

  • CVE-2002-2349Dec 31, 2002
    PhpBB
    Phpbbmod
    risk 0.03cvss —epss 0.02

    phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information.

Page 2 of 8