CVE-2007-2339

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via 1 a modified recipients parameter name in a pm.php; 2 the curr parameter to the b badwords aka censorlist or c banlist module in admin.php; or 3 the "Edit groups / Add group...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...

CVE-2007-2250

admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...

CVE-2007-2248

Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...

Code injection

include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified 1 userids POST parameter or 2 userdata array...

CVE-2007-2249

include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified 1 userids POST parameter or 2 userdata array...

Design/Logic Flaw

admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...

CVE-2007-2248

CVE-2007-2248 involves Phorum, specifically XSS in admin.php prior to 5.1.22. The vulnerabilities affect the group_id parameter in the groups module and the smiley_id parameter in the smileys modsettings module, enabling remote attackers to inject arbitrary web script or HTML. The connected docum...

CVE-2007-2248

Multiple cross-site scripting XSS vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in the groups module or 2 the smileyid parameter in the smileys modsettings module...

CVE-2007-2249

Phorum prior to 5.1.22 contains an injection/privilege escalation issue in include/controlcenter/users.php. Remote authenticated moderators can upgrade their privileges by altering the (1) user_ids POST parameter or (2) userdata array, affecting the authentication/authorization checks in the cont...

CVE-2007-2249

include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified 1 userids POST parameter or 2 userdata array...

CVE-2007-2250

admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module parameter...

CVE-2007-2250

CVE-2007-2250 affects Phorum prior to 5.1.22. The issue is a path disclosure vulnerability in admin.php triggered via the module[] parameter, allowing remote attackers to obtain the full path. The NVD entry lists partial confidentiality impact with no other impacts or exploit details provided in ...

Phorum 5.1.20 - admin.php Groups Module EditAdd Group Field SQL Injection

Phorum 5.1.20 - admin.php Groups Module EditAdd Group Field SQL Injection source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and...

Phorum 5.1.20 - pm.php Recipient Name SQL Injection

Phorum 5.1.20 - pm.php Recipient Name SQL Injection source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues...

Phorum 5.1.20 - admin.php?Groups Module group_id Cross-Site Scripting

Phorum 5.1.20 - admin.php?Groups Module groupid Cross-Site Scripting source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site...

Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

Phorum 5.1.20 - '/include/controlcenter/users.php' Multiple Method Privilege Escalations

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

Phorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently...

Phorum 5.1.20 - includeadminbanlist.php?delete Cross-Site Request Forgery Banlist Deletion

Phorum 5.1.20 - includeadminbanlist.php?delete Cross-Site Request Forgery Banlist Deletion source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection...