CVE-2007-0399

SMF 1.1 RC3 exposes multiple XSS flaws in index.php during the PM “send” action. Infected input (recipient/BCC fields) can inject arbitrary script/HTML in the context of an authenticated user. Affected: Simple Machines Forum (SMF), version 1.1 RC3; vulnerability arises in the PM sending workflow....

CVE-2006-4564

CVE-2006-4564 describes an SQL injection vulnerability in Simple Machines Forum (SMF) 1.1 RC3, occurring in Sources/ManageBoards.php. The vulnerability is exploitable via the cur_cat parameter, enabling remote attackers to execute arbitrary SQL commands. The CVSS v2 base score is 5.1 (Medium) wit...

Sql injections in e107 [Admin section]

Hi, There is a sql injection in SMF 1.1 RC3, in admin section : When an administrator is going to add a new board, the "curcat" parameter is not checked properly : File /Sources/ManageBoards.php, Line 609 : :: // Create a new board... :: if isset$POST'add' :: :: // New boards by default go to the...