CVE-2003-1467

CVE-2003-1467 covers multiple XSS flaws in Phorum prior to 3.4.3 affecting login.php, register.php, post.php, and common.php. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. Affected software: Phorum (before 3.4.3). Underlying cause an...

CVE-2003-1487

Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the 1 UserAdmin program, 2 Edit user profile, or 3 stats program...

CVE-2003-1465

Phorum 3.4–3.4.2 is affected by a directory traversal in download.php that allows remote attackers to read arbitrary files. The vulnerability arises from improper handling of file paths, enabling access to sensitive server files. No remediation or patch details are provided in the supplied docume...

CVE-2003-1486

CVE-2003-1486 affects Phorum 3.4 to 3.4.2. An incorrect HTTP request to one of nine scripts (smileys.php, quick_listrss.php, purge.php, news.php, memberlist.php, forum_listrss.php, forum_list_rdf.php, forum_list.php, move.php) can make the server leak its full path in an error message. This is a ...

CVE-2003-1486

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to 1 smileys.php, 2 quicklistrss.php, 3 purge.php, 4 news.php, 5 memberlist.php, 6 forumlistrss.php, 7 forumlistrdf.php, 8 forumlist.php, or 9 move.php, which leaks the...

CVE-2003-1466

Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via 1 register.php or 2 login.php...

CVE-2003-1467

Multiple cross-site scripting XSS vulnerabilities in 1 login.php, 2 register.php, 3 post.php, and 4 common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2003-1465

Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files...

CVE-2003-1466

CVE-2003-1466 affects Phorum 3.4–3.4.2. Unspecified vulnerability allows remote attackers to use Phorum as a proxy to other sites via (1) register.php or (2) login.php, enabling potential abuse of the application as a gateway to external hosts. The provided documents do not include concrete explo...

CVE-2003-1487

Phorum 3.4 through 3.4.2 contains multiple remote command-injection vulnerabilities that allow arbitrary command execution and modification of Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program. The root cause is not explicitly detailed beyond th...

CVE-2003-1465: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files...

CVE-2003-1466: Undefined Security Weakness

Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via 1 register.php or 2 login.php...

CVE-2003-1486: Exposure of Sensitive Information to an Unauthorized Actor

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to 1 smileys.php, 2 quicklistrss.php, 3 purge.php, 4 news.php, 5 memberlist.php, 6 forumlistrss.php, 7 forumlistrdf.php, 8 forumlist.php, or 9 move.php, which leaks the...

CVE-2003-1467: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 login.php, 2 register.php, 3 post.php, and 4 common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2003-1487: Improper Input Validation

Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the 1 UserAdmin program, 2 Edit user profile, or 3 stats program...

m-phorum 0.3 - index.php Cross-Site Scripting

m-phorum 0.3 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/25394/info m-phorum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code...

m-phorum 0.3 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25394/info m-phorum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

CVE-2007-2338

Cross-site request forgery CSRF vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter...

Sql injection

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...