Filtered by vendor Deluxebb Subscriptions
Filtered by product Deluxebb Subscriptions
Total 29 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2006-4079 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in newpost.php in DeluxeBB 1.08, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the subject parameter (aka the topic title field).
CVE-2006-3303 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
Multiple cross-site scripting (XSS) vulnerabilities in pm.php in DeluxeBB 1.07 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) to parameters.
CVE-2006-3304 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.
CVE-2006-2503 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVE-2006-3797 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
SQL injection vulnerability in DeluxeBB 1.07 and earlier allows remote attackers to bypass authentication, spoof users, and modify settings via the (1) memberpw and (2) membercookie cookies.
CVE-2006-3799 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other variables, by using lowercase "union select" or possibly other statements that do not match the uppercase "UNION SELECT."
CVE-2006-4558 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
CVE-2006-3796 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
DeluxeBB 1.07 and earlier does not properly handle a username composed of a single space character, which allows remote authenticated users to login as the "space" user, post as the guest user, and block the ability of an administrator to ban the "space" user.
CVE-2006-2915 1 Deluxebb 1 Deluxebb 2025-04-03 N/A
Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail, (2) languagex, (3) xthetimeoffset, and (4) xthetimeformat parameters during account registration.