CVE-2006-4450

usercpavatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server as a web proxy by submitting a URL to the avatarurl parameter, which is then used in an HTTP GET request...

CVE-2005-0259

phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file...

CVE-2005-0743

The CVE describes an arbitrary PHP file upload flaw in XOOPS 2.0.9.2 and earlier, exploitable via the uploader.php feature because file extensions are not filtered. This allows remote attackers to upload and potentially execute PHP scripts, with impact on confidentiality, integrity, and availabil...