Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
248 results · page 1 of 5
Oct 23, 2026Improper sanitization in the registration module allows reflected Cross-Site Scripting.CVE-2026-87901 · Websites & servers · phpBB · reported by support@hackerone.comHigh 8.3
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WP w3all phpBB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
- Product
- WP w3all phpBB
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.CVE-2026-78293 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.CVE-2026-73998 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2026SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution oCVE-2026-48613 · Websites & servers · phpBB · reported by support@hackerone.comMedium 5.9
SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated to 3.3.11 or newer yet.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked CVE-2026-48612 · Websites & servers · phpBB · reported by support@hackerone.comHigh 8
Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access iCVE-2026-48611 · Websites & servers · phpBB · reported by support@hackerone.comCritical 9.8
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to CVE-2026-47366 · Websites & servers · phpBB · reported by support@hackerone.comHigh 7.2
Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning.CVE-2026-29199 · Websites & servers · phpBB · reported by support@hackerone.comHigh 8.1
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management fCVE-2025-70811 · Websites & servers · Phpbb · reported by MITREMedium 4.3
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticationCVE-2025-70810 · Websites & servers · Phpbb · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 9, 2025WP w3all phpBB: Cross-Site Request Forgery (CSRF)CVE-2025-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.
- Product
- WP w3all phpBB
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WP w3all phpBB: Cross-Site Request Forgery (CSRF)CVE-2025-32274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.
- Product
- WP w3all phpBB
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 2, 2023A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.CVE-2023-5917 · Websites & servers · Phpbb · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2020A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.CVE-2020-8226 · Websites & servers · Phpbb · reported by support@hackerone.comMedium 5.8
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2020phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.CVE-2019-16108 · Websites & servers · Phpbb · reported by MITREHigh 7.5
phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2020Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.CVE-2019-16107 · Websites & servers · Phpbb · reported by MITREMedium 4.3
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.CVE-2020-5502 · Websites & servers · Phpbb · reported by MITREMedium 6.5
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.phpbb.comphpbb.com
Jan 14, 2020phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.CVE-2020-5501 · Websites & servers · Phpbb · reported by MITREMedium 4.3
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.phpbb.comphpbb.com
Nov 13, 2019phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.CVE-2011-0544 · Websites & servers · phpbb3 · reported by Red HatMedium 6.1
phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.
- Product
- phpbb3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsecurity-tracker.debian.org
Sep 30, 2019In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel.CVE-2019-16993 · Websites & servers · Phpbb · reported by MITREHigh 8.8
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 27, 2019phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature.CVE-2019-13376 · Websites & servers · Phpbb · reported by MITREMedium 6.5
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.phpbb.comssd-disclosure.com
May 5, 2019Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the reCVE-2019-11767 · Websites & servers · Phpbb · reported by MITREMedium 5.8
Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2019The fulltext search component in phpBB before 3.2.6 allows Denial of Service.CVE-2019-9826 · Websites & servers · Phpbb · reported by MITREHigh 7.5
The fulltext search component in phpBB before 3.2.6 allows Denial of Service.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Nov 17, 2018Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization whCVE-2018-19274 · Websites & servers · Phpbb · reported by MITREHigh 7.2
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ripstech.comlists.debian.org
Jan 2, 2018phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content andCVE-2017-1000419 · Websites & servers · Phpbb · reported by MITREHigh 7.5
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpbb.comsec-consult.com
Sep 19, 2017Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and CVE-2015-3880 · Websites & servers · Phpbb · reported by MITREMedium 6.1
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 10, 2015The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers toCVE-2015-1432 · Websites & servers · Phpbb · reported by MITREMedium 6.8
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Feb 10, 2015Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectoCVE-2015-1431 · Websites & servers · Phpbb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Sep 12, 2013Phpbb3 before 3.0.11-4 for Debian GNU/Linux uses world-writable permissions for cache files, which allows local users to modify the file contents via standard fCVE-2013-5724 · Other software · Debian · reported by MITRELow 2.1
Phpbb3 before 3.0.11-4 for Debian GNU/Linux uses world-writable permissions for cache files, which allows local users to modify the file contents via standard filesystem write operations.
- Product
- Phpbb3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecunia.com
May 19, 2010Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances relatedCVE-2010-1630 · Websites & servers · Phpbb · reported by Red HatHigh 7.5
Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
May 19, 2010feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions viaCVE-2010-1627 · Websites & servers · Phpbb · reported by Red HatMedium 4.3
feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 3, 2009SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to CVE-2009-3052 · Other software · Absoluteanime · reported by MITREMedium 6.5
SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.
- Product
- Prime Quick Style
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comabsoluteanime.com
Sep 1, 2009phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the CVE-2008-7143 · Websites & servers · Phpbb · reported by MITREMedium 6.8
phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Aug 24, 2009The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPasCVE-2008-7050 · Other software · Wowraidmanager · reported by MITREHigh 7.5
The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.
- Product
- Wowraidmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2009Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts forCVE-2008-6507 · Websites & servers · Phpbb · reported by MITREMedium 5
Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comopenwall.com
Mar 23, 2009Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors.CVE-2008-6506 · Websites & servers · Phpbb · reported by MITREMedium 5
Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comopenwall.com
Mar 2, 2009PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfCVE-2008-6377 · Websites & servers · Phpbb-seo · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.
- Product
- Multi SEO Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 27, 2009SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via theCVE-2008-6314 · Websites & servers · Phpbb · reported by MITREHigh 7.5
SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
- Product
- TAG Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2009SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the idCVE-2008-6301 · Other software · Prezmo · reported by MITREHigh 7.5
SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
- Product
- Small Shoutbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 16, 2009Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a ..CVE-2009-0592 · Other software · Pnphpbb · reported by MITREHigh 7.5
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.
- Product
- Pnphpbb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 10, 2009Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local files via a ..CVE-2009-0442 · Websites & servers · Phpbbbook · reported by MITREMedium 6.8
Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
- Product
- Phpbbbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2008Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_pCVE-2008-5585 · Other software · Lcxbbportal · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) portal/includes/portal_block.php and (2) includes/acp/acp_lcxbbportal.php.
- Product
- Lcxbbportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecurityreason.com
Sep 18, 2008The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive inCVE-2008-4125 · WordPress plugins & themes · reported by MITREMedium 5
The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as demonstrated by a cross-application attack against WordPress, a different vulnerability than CVE-2006-0632.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsuspekt.orgexchange.xforce.ibmcloud.com
Aug 12, 2008Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when register_globals is enabled, allows remote attackers to inCVE-2008-3600 · Other software · Menalto · reported by MITREMedium 6.8
Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter within a modload action.
- Product
- Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgallery.menalto.comsecunia.com
Jul 18, 2008Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()."CVE-2008-3224 · Websites & servers · Phpbb · reported by MITREHigh 10
Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()."
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2008Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remote attackers to execute arbitrary PHP codCVE-2008-3022 · Websites & servers · Phpbbportal · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remote attackers to execute arbitrary PHP code via a URL in (1) icerikyolu, (2) sayfaid, and (3) uzanti parameters.
- Product
- Phportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
May 28, 2008PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, when register_globals is enabled, allows reCVE-2008-2481 · Websites & servers · Phpraider · reported by MITREHigh 10
PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pConfig_auth[phpbb_path] parameter.
- Product
- Phpraider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.phpraider.comsecunia.com
Apr 12, 2008Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."CVE-2008-1766 · Websites & servers · Phpbb · reported by MITREHigh 10
Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2008Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files viCVE-2008-1565 · Other software · Hotscripts · reported by MITREHigh 7.5
Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
- Product
- Pjirc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.