Filtered by vendor Phpbb Subscriptions
Filtered by product Phpbb Subscriptions
Total 48 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2009-3052 2 Absoluteanime, Phpbb 2 Prime Quick Style, Phpbb 2026-04-23 N/A
SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.
CVE-2007-5688 3 Invision Power Services, Phpbb, Sebflipper 3 Invision Power Board, Phpbb, Multi-forums Module 2026-04-23 N/A
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.
CVE-2006-7168 1 Phpbb 1 Phpbb 2026-04-23 N/A
PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVE-2019-25685 1 Phpbb 1 Phpbb 2026-04-19 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-70810 2 Ariefibis, Phpbb 2 Phpbb3, Phpbb 2026-04-17 8.8 High
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism
CVE-2025-70811 2 Ariefibis, Phpbb 2 Phpbb3, Phpbb 2026-04-17 4.3 Medium
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.
CVE-2002-2346 1 Phpbb 1 Phpbb 2026-04-16 N/A
phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses.
CVE-2001-1471 1 Phpbb 1 Phpbb 2026-04-16 8.8 High
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
CVE-2002-2255 1 Phpbb 1 Phpbb 2026-04-16 N/A
Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in searchuser mode.
CVE-2003-1530 1 Phpbb 1 Phpbb 2026-04-16 N/A
SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.
CVE-2015-3880 1 Phpbb 1 Phpbb 2025-04-20 N/A
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2015-1432 1 Phpbb 1 Phpbb 2025-04-12 N/A
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
CVE-2015-1431 1 Phpbb 1 Phpbb 2025-04-12 N/A
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
CVE-2010-1630 1 Phpbb 1 Phpbb 2025-04-11 N/A
Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."
CVE-2010-1627 1 Phpbb 1 Phpbb 2025-04-11 N/A
feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum.
CVE-2023-5917 1 Phpbb 1 Phpbb 2025-02-27 2.4 Low
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
CVE-2020-8226 1 Phpbb 1 Phpbb 2024-11-21 5.8 Medium
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
CVE-2020-5502 1 Phpbb 1 Phpbb 2024-11-21 6.5 Medium
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
CVE-2020-5501 1 Phpbb 1 Phpbb 2024-11-21 4.3 Medium
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
CVE-2019-9826 1 Phpbb 1 Phpbb 2024-11-21 N/A
The fulltext search component in phpBB before 3.2.6 allows Denial of Service.