CVE-2004-1943: Undefined Security Weakness

PHP remote file inclusion vulnerability in albumportal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbbrootpath parameter...

CVE-2004-2054: Undefined Security Weakness

CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via 1 the mode parameter to privmsg.php or 2 the redirect parameter to login.php...

phpbb 2.0.15 released - patches high critical vuln

I don't normally send an email about updated packages, but this one fixes a potentially serious issue. re: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194 A high risk bbcode.php vulnerability is patched with this version, at the very least please patch it via the link above. It was...

CVE-2004-2055: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php for PhpBB 2.0.4 and 2.0.9 allows remote attackers to inject arbitrary HTMl or web script via the searchauthor parameter...

CVE-2004-1809: Undefined Security Weakness

Cross-site scripting XSS vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 postdays parameter to viewtopic.php or 2 topicdays parameter to viewforum.php...

phpBB 2.0.x - BBCode.php URL Tag

phpBB 2.0.x - BBCode.php URL Tag source: https://www.securityfocus.com/bid/13545/info The phpbb vendor reports that a critical vulnerability exists in the BBCode handling routines of the 'bbcode.php' script. The bbcode url tag is not properly sanitized of user-supplied input. This could permit th...

phpBB 2.0.x - 'BBCode.php' URL Tag

source: https://www.securityfocus.com/bid/13545/info The phpbb vendor reports that a critical vulnerability exists in the BBCode handling routines of the 'bbcode.php' script. The bbcode url tag is not properly sanitized of user-supplied input. This could permit the injection of arbitrary HTML or...

CVE-2005-1378

SQL injection vulnerability in postingnotes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, which is used in the $postid variable, and other attack vectors...

CVE-2005-1378

The CVE-2005-1378 issue is a SQL injection in phpBB’s notes module (posting_notes.php) where the p parameter sets the $post_id, enabling remote execution of arbitrary SQL. Affected component: phpBB notes module; vulnerability caused by unsafely using user-supplied input in SQL queries. NVD lists ...

CVE-2005-1378

SQL injection vulnerability in postingnotes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, which is used in the $postid variable, and other attack vectors...

CVE-2005-1171

Cross-site scripting XSS vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2005-0673

Cross-site scripting XSS vulnerability in usercpregister.php for phpBB 2.0.13 allows remote attackers to inject arbitrary web script or HTML by setting the 1 allowhtml, 2 allowbbcode, or 3 allowsmilies parameters to inject HTML into signatures for personal messages, possibly when they are process...

CVE-2005-1290

Multiple cross-site scripting XSS vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 u parameter to profile.php, 2 highlight parameter to viewtopic.php, or 3 forumname or forumdesc parameters to adminforums.php...

CVE-2005-0673

Cross-site scripting XSS vulnerability in usercpregister.php for phpBB 2.0.13 allows remote attackers to inject arbitrary web script or HTML by setting the 1 allowhtml, 2 allowbbcode, or 3 allowsmilies parameters to inject HTML into signatures for personal messages, possibly when they are process...

CVE-2005-0614

sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie...

CVE-2005-1234

Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via the 1 u parameter to auctionrating.php or 2 ar parameter to actionoffer.php...

CVE-2005-1290

Multiple cross-site scripting XSS vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 u parameter to profile.php, 2 highlight parameter to viewtopic.php, or 3 forumname or forumdesc parameters to adminforums.php...

CVE-2005-1026

Multiple SQL injection vulnerabilities in SnailSource phpBB 2.0.x mods allow remote attackers to execute arbitrary SQL commands via the 1 fileid parameter to dlman.php in DLMan Pro or 2 id parameter to links.php in Linkz Pro aka LinksLinks Pro...

CVE-2005-1113

Multiple cross-site scripting XSS vulnerabilities in PhpBB Plus 1.52 and earlier allow remote attackers to inject arbitrary web script or HTML via the bsid parameter to 1 groupcp.php, 2 index.php, 3 portal.php, 4 viewforum.php, or 5 viewtopic.php, 6 the c parameter to index.php, or 7 the article...

CVE-2005-1114

Multiple SQL injection vulnerabilities in albumsearch.php in Photo Album 2.0.53 for phpBB allow remote attackers to execute arbitrary SQL commands via the 1 mode or 2 search parameters...