phpbb group vulnerabilities

Recent CVEs affecting phpbb group products. 90 tracked.

phpbb group has 90 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2007-03-27. Highest priority: CVE-2002-2176 (score 62/100).

CVE-2007-1695 HIGH 10.0 DOWNGRADE PHP remote file inclusion vulnerability in includes/usercp_register.php in phpBB 2.0.19 allows remote attacker
CVE-2006-7077 MEDIUM 6.8 DOWNGRADE SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to ex
CVE-2006-7076 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote at
CVE-2006-6841 HIGH 10.0 DOWNGRADE Certain forms in phpBB before 2.0.22 lack session checks, which has unknown impact and remote attack vectors.
CVE-2006-6840 HIGH 10.0 DOWNGRADE Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to a "ne
CVE-2006-6839 HIGH 10.0 DOWNGRADE Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to "crit
CVE-2006-6508 MEDIUM 6.0 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unau
CVE-2006-6421 MEDIUM 6.0 DOWNGRADE Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.
CVE-2006-5435 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in groupcp.php in phpBB 2.0.10 and earlier allows remote attackers to
CVE-2006-5209 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Admin Topic Action Logging
CVE-2006-4779 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 an
CVE-2006-4758 MEDIUM 4.6 DOWNGRADE phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrativ
CVE-2006-4450 MEDIUM 5.1 DOWNGRADE usercp_avatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server
CVE-2006-3940 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL comman
CVE-2006-2865 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrar
CVE-2006-2360 HIGH 7.5 MITIGATE SQL injection vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to execute arbitr
CVE-2006-2359 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to i
CVE-2006-2245 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in auction\auction_common.php in Auction mod 1.3m for phpBB allows rem
CVE-2006-2219 MEDIUM 5.0 DOWNGRADE phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functio
CVE-2006-2152 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, w
CVE-2006-2151 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globa
CVE-2006-2150 MEDIUM 6.4 DOWNGRADE PHP remote file inclusion vulnerability in top/list.php in phpBB TopList 1.3.8 and earlier allows remote attac
CVE-2006-2134 MEDIUM 5.1 UPGRADE PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 an
CVE-2006-1775 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary
CVE-2006-1603 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbi
CVE-2006-0632 MEDIUM 6.4 DOWNGRADE The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the
CVE-2006-0450 MEDIUM 5.0 DOWNGRADE phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) regis
CVE-2006-0438 MEDIUM 5.0 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG)
CVE-2006-0437 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to injec
CVE-2006-0063 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote a
CVE-2005-4358 MEDIUM 5.0 DOWNGRADE admin/admin_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct
CVE-2005-4357 LOW 2.6 DOWNGRADE Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote a
CVE-2005-3799 MEDIUM 5.0 DOWNGRADE phpBB 2.0.18 allows remote attackers to obtain sensitive information via a large SQL query, which generates an
CVE-2005-3537 MEDIUM 5.0 DOWNGRADE A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages
CVE-2005-3536 HIGH 7.5 DOWNGRADE SQL injection vulnerability in phpBB 2 before 2.0.18 allows remote attackers to execute arbitrary SQL commands
CVE-2005-3420 HIGH 7.5 DOWNGRADE usercp_register.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code
CVE-2005-3419 HIGH 7.5 DOWNGRADE SQL injection vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to execute arbitrar
CVE-2005-3418 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inje
CVE-2005-3417 HIGH 7.5 DOWNGRADE phpBB 2.0.17 and earlier, when the register_long_arrays directive is disabled, allows remote attackers to modi
CVE-2005-3416 HIGH 7.5 DOWNGRADE phpBB 2.0.17 and earlier, when register_globals is enabled and the session_start function has not been called
CVE-2005-3415 HIGH 7.5 DOWNGRADE phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variab
CVE-2005-3310 LOW 3.5 DOWNGRADE Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authe
CVE-2005-2161 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in phpBB 2.0.16 allows remote attackers to inject arbitrary web scrip
CVE-2005-2086 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers t
CVE-2005-1290 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inje
CVE-2005-1235 MEDIUM 5.0 DOWNGRADE auction_my_auctions.php in phpbb-Auction 1.2m and earlier allows remote attackers to obtain sensitive informat
CVE-2005-1234 MEDIUM 5.0 DOWNGRADE Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL comman
CVE-2005-1196 HIGH 7.5 MITIGATE SQL injection vulnerability in kb.php in the Knowledge Base module for phpBB allows remote attackers to obtain
CVE-2005-1193 HIGH 7.5 DOWNGRADE The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewto
CVE-2005-1116 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in the Calendar module for phpBB allow remote attackers to inject arb
CVE-2005-1115 MEDIUM 4.3 DOWNGRADE DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Photo Album 2.0.53 module for phpBB allow remote attack
CVE-2005-1114 HIGH 7.5 DOWNGRADE DOWNGRADE Multiple SQL injection vulnerabilities in album_search.php in Photo Album 2.0.53 for phpBB allow remote attack
CVE-2005-1113 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in PhpBB Plus 1.52 and earlier allow remote attackers to i
CVE-2005-1047 HIGH 7.5 DOWNGRADE Meilad File upload script (up.php) mod for phpBB 2.0.x does not properly limit the types of files that can be
CVE-2005-0872 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in calendar_scheduler.php in the Topic Calendar 1.0.1 module for phpB
CVE-2005-0871 MEDIUM 5.0 DOWNGRADE calendar_scheduler.php in Topic Calendar 1.0.1 module for phpBB, when running on a Microsoft IIS server, allow
CVE-2005-0673 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in usercp_register.php for phpBB 2.0.13 allows remote attackers to in
CVE-2005-0659 MEDIUM 5.0 DOWNGRADE phpBB 2.0.13 and earlier allows remote attackers to obtain sensitive information via a direct request to oracl
CVE-2005-0614 HIGH 7.5 DOWNGRADE sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the auto
CVE-2005-0603 MEDIUM 5.0 DOWNGRADE viewtopic.php in phpBB 2.0.12 and earlier allows remote attackers to obtain sensitive information via a highli
CVE-2005-0259 MEDIUM 6.4 DOWNGRADE phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local user
CVE-2005-0258 MEDIUM 5.0 DOWNGRADE Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and p
CVE-2004-2350 HIGH 7.5 DOWNGRADE SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbit
CVE-2004-2130 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in privmsg.php in phpBB 2.0.6 allow remote attackers to ex
CVE-2004-2055 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in search.php for PhpBB 2.0.4 and 2.0.9 allows remote attackers to in
CVE-2004-2054 MEDIUM 5.0 DOWNGRADE CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitti
CVE-2004-1950 MEDIUM 5.0 DOWNGRADE phpBB 2.0.8a and earlier trusts the IP address that is in the X-Forwarded-For in the HTTP header, which allows
CVE-2004-1943 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote atta
CVE-2004-1809 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitra
CVE-2004-1535 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote atta
CVE-2004-1315 HIGH 7.5 DOWNGRADE viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words
CVE-2004-0730 MEDIUM 6.8 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary
CVE-2004-0729 MEDIUM 5.0 DOWNGRADE PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid (1) category_rows parameter t
CVE-2004-0339 MEDIUM 6.8 DOWNGRADE Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote
CVE-2003-1373 MEDIUM 6.8 DOWNGRADE Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read an
CVE-2003-1244 HIGH 7.5 DOWNGRADE SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute
CVE-2003-1216 HIGH 7.5 DOWNGRADE SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbit
CVE-2003-1215 MEDIUM 4.6 DOWNGRADE SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unau
CVE-2003-0486 MEDIUM 5.0 UPGRADE SQL injection vulnerability in viewtopic.php for phpBB 2.0.5 and earlier allows remote attackers to steal pass
CVE-2003-0484 MEDIUM 6.8 MITIGATE Cross-site scripting (XSS) vulnerability in viewtopic.php for phpBB allows remote attackers to insert arbitrar
CVE-2002-2176 HIGH 10.0 DOWNGRADE SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the
CVE-2002-1894 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in viewtopic.php in phpBB 2.0.3 allows remote attackers to inject arb
CVE-2002-1707 MEDIUM 5.0 DOWNGRADE install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on
CVE-2002-1537 HIGH 10.0 DOWNGRADE admin_ug_auth.php in phpBB 2.0.0 allows local users to gain administrator privileges by directly calling admin
CVE-2002-0902 HIGH 7.5 DOWNGRADE Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as ot
CVE-2002-0533 MEDIUM 5.0 DOWNGRADE phpBB 1.4.4 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and
CVE-2002-0475 MEDIUM 5.1 DOWNGRADE Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Jav
CVE-2002-0473 HIGH 10.0 DOWNGRADE db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remot
CVE-2001-1482 HIGH 7.5 DOWNGRADE SQL injection vulnerability in bb_memberlist.php for phpBB 1.4.2 allows remote attackers to execute arbitrary
CVE-2001-1472 MEDIUM 4.6 DOWNGRADE SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute

FAQ

How do I fix phpbb group vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is phpbb group being exploited right now?

None of the tracked phpbb group CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which phpbb group CVE should I patch first?

CVE-2002-2176 currently ranks highest (62/100): SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the .

Products

RSS feed for phpbb group · ← Back to latest CVEs