CVE-2003-0395

CVE-2003-0395 affects Ultimate PHP Board (UPB) 1.9. A remote attacker can execute arbitrary PHP code with UPB administrator privileges by sending PHP commands in the HTTP User-Agent header; code is executed when the administrator processes admin_iplog.php. The issue is caused by unsafely handling...

CVE-2015-2217

Ultimate PHP Board (UPB, also known as myUPB) is affected by multiple XSS vulnerabilities. The CVE-2015-2217 entry describes remote XSS via the q parameter in search.php or the avatar parameter in profile.php, with impact described as injection of arbitrary web script/HTML. Public sources within ...

CVE-2025-61540

The message board software Ultimate PHP Board version 2.2.7 is susceptible to a SQL injection vulnerability. The root cause is an unvalidated username field within the lostpassword.php file, which allows an attacker to inject malicious SQL code. Successful exploitation could compromise the underl...

CVE-2025-61539

Ultimate PHP Board version 2.2.7 is vulnerable to a Cross-Site Scripting (XSS) attack due to improper handling of the u_name parameter within the lostpassword.php file. An attacker can exploit this by manipulating the parameter to inject and execute malicious scripts. To mitigate this risk, users...