CVE-2026-43621: Incorrect Authorization

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2013-4395: Improper Neutralization of Input During Web Page Generation

Simple Machines Forum SMF through 2.0.5 has XSS...

CVE-2013-7467: Improper Neutralization of Input During Web Page Generation

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

CVE-2013-7466: Improper Limitation of a Pathname to a Restricted Directory

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7234: Improper Input Validation

Simple Machines Forum SMF before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header...

PT-2014-3297

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF versions prior to 1.1.19 Simple Machines Forum SMF versions 2.x prior to 2.0.6 Description The issue allows remote attackers to impersonate arbitrary users by utilizing multiple space characters. Recommendations For...

CVE-2012-5903: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php...

CVE-2011-3615: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...

CVE-2011-1131: Exposure of Sensitive Information to an Unauthorized Actor

The PlushSearch2 function in Search.php in Simple Machines Forum SMF before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created,...

PT-2011-2892

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF versions prior to 1.1.13 Simple Machines Forum SMF versions 2.x prior to 2.0 RC5 Description The issue is related to the loadUserSettings function in Load.php, which does not properly handle invalid login attempts. Th...

CVE-2011-1129: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum SMF before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a saveitems action...

CVE-2008-6741: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Load.php in Simple Machines Forum SMF 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the dbcharacterset parameter to a multibyte character set such as big5, which causes the addslashes PHP function to produce a "" backslash...

CVE-2008-6657: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action...

CVE-2008-6658: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

CVE-2008-2019: Undefined Security Weakness

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2008-0775: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sboxDB.php in Simple Machines Forum SMF Shoutbox 1.14 through 1.16b allows remote attackers to inject arbitrary web script or HTML via strings to the shoutbox form that start with "", contain the desired script, and end with ";"...

CVE-2007-3309: Undefined Security Weakness

Unspecified vulnerability in Simple Machines Forum SMF 1.1.2 allows remote attackers to execute arbitrary PHP code during 1 creation or 2 editing of a message...

CVE-2007-2546: Improper Authentication

Session fixation vulnerability in Simple Machines Forum SMF 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-0399: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

CVE-2006-5503: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...