CVE-2008-6971

CVE-2008-6971 describes a by-design weakness in Simple Machines Forum (SMF) where password reset codes are generated using an insecure random-number state exposed in a hidden form field. A remote attacker could predict validation codes for the password reset, enabling modification of other users’...

CVE-2011-1127

Simple Machines Forum (SMF) is affected by CVE-2011-1127. The issue lies in SSI.php, where guest access is not properly restricted, allowing remote attackers to cause an unspecified impact via unknown vectors. Affected products/versions: SMF 1.1.12 and earlier (pre-1.1.13) and SMF 2.x prior to 2....

CVE-2011-1128

The CVE-2011-1128 issue affects Simple Machines Forum (SMF): loadUserSettings in Load.php fails to properly handle invalid login attempts, enabling brute-force access or potential denial of service. Affected: SMF < 1.1.13 and SMF 2.x

CVE-2011-1129

CVE-2011-1129 is a cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) via the EditNews function in ManageNews.php. It affects SMF versions before 1.1.13 and 2.x before 2.0 RC5, where remote authenticated users could inject arbitrary web script or HTML through a save_items act...

CVE-2011-1131

SMF: The PlushSearch2 function in Search.php affects SMF 1.1.13 and SMF 2.x up to 2.0 RC5, where cached data may be used in a scenario with a temporary table, potentially allowing remote attackers to retrieve sensitive information via a search. Impact is a partial confidentiality breach; no integ...

CVE-2006-4564

CVE-2006-4564 describes an SQL injection vulnerability in Simple Machines Forum (SMF) 1.1 RC3, occurring in Sources/ManageBoards.php. The vulnerability is exploitable via the cur_cat parameter, enabling remote attackers to execute arbitrary SQL commands. The CVSS v2 base score is 5.1 (Medium) wit...

CVE-2011-1130

SMF is affected by SQL injection in the start parameter validation in the code paths cleanRequest (QueryString.php) and constructPageIndex (Subs.php). The issue affects SMF releases before 1.1.13 and 2.x before 2.0 RC5, enabling remote attackers to perform SQL injection, potentially disclose data...

CVE-2011-4173

The data confirms CVE-2011-4173 is a CSRF vulnerability in Simple Machines Forum (SMF) 2.x prior to 2.0.1, enabling remote attackers to hijack administrator/moderator sessions via image-file related vectors. Affected product/component: SMF 2.x (before 2.0.1); root cause is a cross-site request fo...

CVE-2011-3615

CVE-2011-3615 affects Simple Machines Forum (SMF). Remote attackers can exploit multiple SQL injection vulnerabilities via two vectors: (1) HTML entity handling and (2) display name processing. Affected software includes SMF versions before 1.1.15 and 2.x before 2.0.1. The underlying issue allows...