CVE-2009-3052

SQL injection vulnerability in root/includes/primequickstyle.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the primequickstyle parameter to ucp.php...

CVE-2008-7143

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header...

CVE-2008-7143

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header...

CVE-2008-7143

phpBB 2.0.23 is affected. When a moderator/administrator closes a thread, the session ID can be exposed in a Referer header during a post that includes a URL to a remotely hosted image, enabling remote attackers to hijack the user session. The NVD entry lists CVSS v2 metrics: AV:N/AC:M/Au:N/C:P/I...

FreeBSD : phpBB IP address spoofing (cfe17ca6-6858-4805-ba1d-a60a61ec9b4d)

The common.php script always trusts the X-Forwarded-For' header in the client's HTTP request. A remote user could forge this header in order to bypass any IP address access control lists ACLs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : Critical SQL injection in phpBB (70f5b3c6-80f0-11d8-9645-0020ed76ef5a)

Anyone can get admin's username and password's md5 hash via a single web request. A working example is provided in the advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

phpBB Account Re-Activation Authentication Bypass Vulnerability

According to its version number, the remote version of phpbb is prone to an authentication-bypass vulnerability because it fails to properly enforce privilege requirements on some operations. Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which m...

phpBB < 3.0.4 Authentication Bypass Vulnerability

phpBB is prone to an authentication bypass vulnerability because it fails to properly enforce privilege requirements on some operations. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2008-6507

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum...

Design/Logic Flaw

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors...

Default credentials

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum...

CVE-2008-6507

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum...

CVE-2008-6506

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors...

CVE-2008-6506

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors...

CVE-2008-6507

The vulnerability CVE-2008-6507 affects phpBB before 3.0.4, per multiple sources (NVD, Red Hat, Ubuntu, GHSA, osv) describing an unspecified information-disclosure issue related to the lack of password prompts for a private message quoting a post in a password-protected forum. Root cause: insuffi...

CVE-2008-6506

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors...

CVE-2008-6506

CVE-2008-6506 affects phpBB prior to 3.0.4, enabling an authentication bypass that allows activating deactivated accounts via unknown vectors. The OpenVAS entry confirms an account activation bypass vulnerability in phpBB, with affected versions up to 3.0.3. Practical impact is unauthorized acces...

CVE-2008-6507

Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum...

phpBB Forum Detection (HTTP)

HTTP based detection of phpBB. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100033";...

phpBB 'ucp.php' XSS Vulnerability

According to its version number, the remote version of phpbb is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. UPDATE March 13, 2009: The referenced BID is being retired because the issue cannot be exploited as described...