punbb vulnerabilities and fixes

Recent CVEs affecting punbb, with upgrade or downgrade steps. 43 tracked.

punbb has 43 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2021-03-22. Highest priority: CVE-2008-3335 (score 56/100).

• CVE-2021-28968 MEDIUM 5.4 UPGRADE An issue was discovered in PunBB before 1.4.6
• CVE-2011-3371 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remot
• CVE-2010-0455 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in forum/viewtopic.php in PunBB 1.3 allows remote attackers to inject
• CVE-2009-4894 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in profile.php in PunBB before 1.3.4 allow remote attacker
• CVE-2008-7241 MEDIUM 6.8 UPGRADE Cross-site request forgery (CSRF) vulnerability in PunBB before 1.2.17 allows remote attackers to hijack the a
• CVE-2008-5435 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in moderate.php in PunBB before 1.3.1 allows remote attackers to inje
• CVE-2008-5434 MEDIUM 6.5 DOWNGRADE Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to exe
• CVE-2008-5433 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and 1.3.1 allows remote attackers to inject
• CVE-2008-3968 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inj
• CVE-2008-3336 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject ar
• CVE-2008-3335 HIGH 10.0 UPGRADE Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via
• CVE-2008-1485 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitra
• CVE-2008-1484 LOW 3.5 DOWNGRADE The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system tim
• CVE-2007-6527 MEDIUM 5.8 DOWNGRADE uploadimg.php in the Automatic Image Upload with Thumbnails (imgUpload) module 1.3.2 for PunBB only verifies t
• CVE-2007-2236 MEDIUM 6.8 UPGRADE footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a c
• CVE-2007-2235 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in PunBB 1.2.14 and earlier allow remote attackers to inje
• CVE-2007-2234 HIGH 7.5 UPGRADE include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled ini_get function when check
• CVE-2006-5738 HIGH 7.2 UPGRADE Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to exe
• CVE-2006-5737 HIGH 7.2 DOWNGRADE PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin
• CVE-2006-5736 MEDIUM 5.1 UPGRADE SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to C
• CVE-2006-5735 HIGH 7.5 UPGRADE Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated use
• CVE-2006-4759 LOW 3.6 DOWNGRADE PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenti
• CVE-2006-2724 MEDIUM 6.8 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject
• CVE-2006-2227 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in misc.php in PunBB 1.2.11 allows remote attackers to inject arbitra
• CVE-2006-1090 HIGH 7.8 DOWNGRADE register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of
• CVE-2006-1089 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbit
• CVE-2006-0866 MEDIUM 5.0 DOWNGRADE PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's pass
• CVE-2006-0865 MEDIUM 5.0 DOWNGRADE PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by regist
• CVE-2005-4688 MEDIUM 5.0 DOWNGRADE PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which mi
• CVE-2005-4687 MEDIUM 5.0 DOWNGRADE DOWNGRADE PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarde
• CVE-2005-4686 MEDIUM 5.0 DOWNGRADE PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals
• CVE-2005-4665 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrar
• CVE-2005-3518 HIGH 7.5 DOWNGRADE SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrar
• CVE-2005-3328 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to
• CVE-2005-3079 MEDIUM 4.6 DOWNGRADE PunBB before 1.2.8 allows remote attackers to perform "code inclusion" via the user language selection.
• CVE-2005-3078 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB before 1.2.8 allows remote attackers to inject arbitrary web
• CVE-2005-2193 HIGH 7.5 DOWNGRADE SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows
• CVE-2005-1072 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows remote attackers to inject arbitrary web
• CVE-2005-1051 MEDIUM 6.5 DOWNGRADE SQL injection vulnerability in profile.php in PunBB 1.2.4 allows remote authenticated users to execute arbitra
• CVE-2005-0818 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script
• CVE-2005-0571 MEDIUM 5.0 DOWNGRADE admin_loader.php in PunBB 1.2.1 allows remote attackers to read arbitrary files via the plugin parameter.
• CVE-2005-0570 MEDIUM 5.0 DOWNGRADE profile.php in PunBB 1.2.1 allows remote attackers to cause a denial of service (account lockout) by setting t
• CVE-2005-0569 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands

FAQ

How do I fix punbb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is punbb being exploited right now?

None of the tracked punbb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which punbb CVE should I patch first?

CVE-2008-3335 currently ranks highest (56/100): Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via.

RSS feed for punbb · ← Back to latest CVEs