PatchTheCVE: cyboards php litehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2008-3710: Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and ehttps://patchthecve.com/cve/CVE-2008-3710.htmlhttps://patchthecve.com/cve/CVE-2008-3710.htmlTue, 16 Jun 2026 22:56:21 +0000MEDIUM 5.1: Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) script_path parameter to (a) options.php and the (2) lang_code parameter to (b) copy_vip.php and (c) process_edit_boCVE-2008-3709: Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to injecthttps://patchthecve.com/cve/CVE-2008-3709.htmlhttps://patchthecve.com/cve/CVE-2008-3709.htmlTue, 16 Jun 2026 22:56:21 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML via the (1) lOptionsOptions, (2) lNavAdminOptions, or (3) lNavReturn parameter to options.php; or the (4) lNavReturn parameter to subscribe.php.CVE-2008-3707: Multiple PHP remote file inclusion vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to executehttps://patchthecve.com/cve/CVE-2008-3707.htmlhttps://patchthecve.com/cve/CVE-2008-3707.htmlTue, 16 Jun 2026 22:56:21 +0000HIGH 7.5: Multiple PHP remote file inclusion vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to execute arbitrary PHP code via a URL in the script_path parameter to (1) flat_read.php, (2) post.php, (3) process_post.php, (4) process_search.php, (5) forum.php, (6) process_subscribe.php, (7) reaCVE-2007-1983: PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote https://patchthecve.com/cve/CVE-2007-1983.htmlhttps://patchthecve.com/cve/CVE-2007-1983.htmlTue, 16 Jun 2026 22:38:41 +0000HIGH 7.5: PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter, a different vector than CVE-2006-2871.CVE-2006-2871: PHP remote file inclusion vulnerability in include/common.php in CyBoards PHP Lite 1.25 allows remote attackerhttps://patchthecve.com/cve/CVE-2006-2871.htmlhttps://patchthecve.com/cve/CVE-2006-2871.htmlTue, 16 Jun 2026 22:25:56 +0000HIGH 7.5: PHP remote file inclusion vulnerability in include/common.php in CyBoards PHP Lite 1.25 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter. NOTE: CVE disputes this issue, since $script_path is set to a constant valueCVE-2006-1134: SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackhttps://patchthecve.com/cve/CVE-2006-1134.htmlhttps://patchthecve.com/cve/CVE-2006-1134.htmlTue, 16 Jun 2026 22:22:05 +0000MEDIUM 5.1: SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.