phpBB < 3.3.17 - Authentication Bypass

phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - Avis n°06 - 25/02/05 Programme : phpBB 2.0.12 Page d'accueil : http://www.phpbb.com Versions vulnérables : phpBB 2.0.12 et versions antérieures Risque : Risque faible !! Impact : Divulgation du chemin complet root@kitploit:...

CVE-2026-48611-EXPLOIT

CVE-2026-48611 – Эксплойт для перехвата учетных записей phpBB OAuth Неаутентифицированный захват учетных записей | CVSS 9.4 Критический | Готов к использованию 🔥 Что вы получаете Полностью рабочий эксплойт на Python для CVE-2026-48611 Массовый сканер — автоматически проверяет тысячи целей Генерат...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Contournement de l'authentification poc simple de contournement d'auth si vous voulez y accéder via un navigateur n'oubliez pas de modifier la variable USERAGENT dans le script selon ce qui est affiché dans votre navigateur pour que cela fonctionne. utilisez un éditeur de...

CVE-2026-73998

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73998

The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73998 WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2006-0450-phpBB-2.0.15-Multiple-DoS-Vulnerabilities

Neo Security Team NST® - アドバイザリ 15 - 00/00/06 プログラム: phpBB 2.0.15 ホームページ: http://www.phpbb.com 影響を受けるバージョン: phpBB 2.0.15 および下位バージョン リスク: 高リスク!! 影響: 複数の DoS 脆弱性。 説明 phpBB は、高性能で、完全にスケーラブルで、高度にカスタマイズ可能な オープンソースの掲示板パッケージです。phpBB は、ユーザーフレンドリーな インターフェース、シンプルで分かりやすい管理パネル、そして 役立つ FAQ を備えています。強力な PHP...

Insufficient Granularity of Access Control

Overview phpbb/phpbb is a Forum Software application. Affected versions of this package are vulnerable to Insufficient Granularity of Access Control due to improper verification of access permissions in the Administration Control Panel ACP. An attacker can obtain elevated privileges by modifying...

CVE-2026-48613

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated ...

CVE-2026-48613

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated ...

CVE-2026-48613

Affects phpBB forums that were upgraded from versions prior to 3.3.8 and have not been updated to 3.3.11 or newer. The issue lies in the profile field migration process where user-supplied profile field data is not properly sanitized, allowing an SQL injection. The vulnerability enables execution...

PT-2026-48828

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.11 Description An issue exists in the profile field migration process where user-supplied profile field data is handled improperly. This allows for the execution of arbitrary SQL queries, a technique known as SQL...

GHSA-7GM6-W7MX-58CR phpBB has Password Reset Link Poisoning via Host Header injection

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

Weak Password Recovery Mechanism for Forgotten Password

Overview phpbb/phpbb is a Forum Software application. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via the forceservervars configuration being disabled. An attacker can cause password reset emails to contain links to attacker-controll...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

CVE-2026-29199

CVE-2026-29199 affects phpBB prior to 3.3.16. The issue is a Host Header Injection in which, when force_server_vars is disabled, the server hostname is sourced from the HTTP Host header to build the password reset URL. An attacker who can control or influence the Host header can cause password re...