CVE-2019-12490

SMF contains a reverse tabnabbing flaw (CVE-2019-12490) in which external links opened with _blank can enable credential theft when a user visits a crafted site. Affected: Simple Machines Forum before 2.0.16. Root cause: improper handling of external links (target="_blank"). Impact documented as ...

Simple Machines Forum (SMF) Reverse Tag Phishing Vulnerability

Simple Machines Forum is developed by Simple Machines open source Internet forums , message board programs. A reverse tag phishing vulnerability exists in Simple Machines Forum SMF versions prior to 2.0.16. The vulnerability stems from the use of blank for external links. An attacker can exploit...

CVE-2009-5068

There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...

CVE-2009-5068

The CVE concerns Simple Machines Forum (SMF) up to version 2.0.3. In some deployments, co-admins with access to the same SMF instance can read arbitrary files, including settings.php containing database passwords, enabling privilege escalation. No specific exploit details or mitigations are provi...

Comodo Forums Hack Exposes 245,000 Users' Data — Recent vBulletin 0-day Used

If you have an account with the Comodo discussion board and support forums, also known as ITarian Forum, you should change your password immediately. Cybersecurity company Comodo has become one of the major victims of a recently disclosed vBulletin 0-day vulnerability, exposing login account...

Simple Machines Forum (SMF) <= 2.0.4 Multiple Vulnerabilities

Simple Machines Forum SMF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Simple Machines Forum Code Injection Vulnerability

Simple Machines Forum SMF is an open source web forum system by the SMF team in the United States. A security vulnerability exists in SMF version 2.0.4. An attacker can exploit the vulnerability to inject PHP code with the help of the 'dictionary' parameter...

Cross site scripting

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

CVE-2013-7468

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

CVE-2013-7466

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7467

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

Code injection

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

CVE-2013-7466

Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...

CVE-2013-7467

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

Design/Logic Flaw

The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum SMF before 2.0.15 does not properly use the possibleusers variable in a query, which might allow attackers to bypass intended access restrictions...

CVE-2018-10305

The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum SMF before 2.0.15 does not properly use the possibleusers variable in a query, which might allow attackers to bypass intended access restrictions...

CVE-2018-10305

CVE-2018-10305 (SMF) affects Simple Machines Forum prior to 2.0.15. The root cause is the MessageSearch2 function in PersonalMessage.php not properly using the possible_users variable in a query, enabling a remote attacker to bypass intended access restrictions. Impact is a security bypass of acc...

Simple Machines Forum Access Restriction Bypass Vulnerability

Simple Machines Forum is an open source, Internet forum, message board program developed by Simple Machines. An access restriction bypass vulnerability exists in Simple Machines Forum before 2.0.15. The vulnerability arises because the MessageSearch2 function in PersonalMessage.php in Simple...

CVE-2016-5726

Packages.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter...

CVE-2016-5727

LogInOut.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop...