39 matches found
CVE-2022-1252
CVE-2022-1252 concerns gnuboard/gnuboard5 (versions up to and including 5.5.5). The vulnerability stems from the use of a broken or risky cryptographic algorithm, allowing an attacker to derive a user’s email address and potentially send emails to arbitrary addresses with full content control. Ro...
CVE-2018-18668
GNUBOARD5 before 5.3.2.0 is affected by a cross-site scripting (XSS) vulnerability in the homepage title parameter (adm/config_form_update.php cf_title). Exploitation allows remote attackers to inject arbitrary web script/HTML, potentially compromising user sessions and browser execution context....
CVE-2025-61464
The gnuboard4 content management system (versions v4.36.04 and before ) is vulnerable to a Second-order SQL Injection located in the search_table parameter within the bbs/search.php file. This vulnerability allows for potential unauthorized database access or modification . Remediation involves u...
CVE-2022-44216
Gnuboard versions 5.5.4 and 5.5.5 are reported vulnerable to an insecure permissions issue that lets an attacker change the password of all users without knowing any victim’s password. The provided documents consistently describe this vulnerability as an account-management/privilege-control flaw ...
CVE-2024-24157
Gnuboard g6 , a FastAPI-based content management system, is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the board.py file and affects versions prior to the commit c2cc1f5069e00491ea48618d957332d90f6d40e4 . This vulnerability stems from the improper neutralization of input during...
CVE-2022-30050
CVE-2022-30050 affects Gnuboard versions 5.55 and 5.56, with a Cross-Site Scripting (XSS) flaw in the file path bbs/member_confirm.php . The root cause is insufficient validation/output handling of user-supplied data, enabling script execution on the client side. Reported by multiple sources (CNV...
CVE-2014-2339
CVE-2014-2339 concerns GNUboard 5.x (and possibly earlier) with multiple SQL injection vulnerabilities in the file bbs/ajax.autosave.php . The flaws allow remote authenticated users to execute arbitrary SQL commands via the parameters subject or content . Exploitation is documented in multiple so...
CVE-2024-41475
Gnuboard g6 version 6.0.7 is vulnerable to session hijacking due to a CORS misconfiguration (origin validation error). This flaw allows for unauthorized access to user sessions. To remediate the issue, users should update the CORS configuration to properly restrict access. As a temporary workarou...
CVE-2004-1403
CVE-2004-1403 affects GNUBoard ≤3.39; a PHP remote file inclusion in index.php via the doc parameter lets an attacker reference a URL on a remote server to execute arbitrary PHP code. The issue is a remote inclusion flaw enabling code execution with web server privileges; connected Nessus/SIR ent...
CVE-2022-3963
CVE-2022-3963 affects gnuboard5, targeting the FAQ Key ID Handler in file bbs/faq.php. The issue is a cross-site scripting (XSS) vulnerability caused by manipulating the fm_id parameter, enabling remote exploitation. A fix is available in version 5.5.8.2.1, with patch identifier ba062ca5b62809106...
CVE-2024-24156
A Cross Site Scripting (XSS) vulnerability exists in Gnuboard g6 versions prior to Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5 . The flaw allows remote attackers to execute arbitrary code by exploiting the wr_content parameter. This can lead to the injection of malicious scripts into t...
CVE-2024-39097
Gnuboard versions 6.0.4 and below are susceptible to an Open Redirect vulnerability. The root cause is a flaw in the url parameter within the login path , which can be exploited by an attacker to redirect users to a malicious website. To mitigate this issue, it is recommended to upgrade to versio...
CVE-2011-4066
Gnuboard 4.33.02 and earlier contains a PATH_INFO-based SQL injection in bbs/tb.php that allows remote attackers to execute arbitrary SQL commands. Multiple sources (NVD entry CVE-2011-4066, Seebug/Exploit-DB listings) document this vulnerability and provide exploit examples, indicating that expl...
CVE-2012-4873
GNUBoard is vulnerable to an XSS in the file_download function via the filename parameter, affecting versions before 4.34.21. The root cause is improper handling of the filename input leading to script/HTML injection. Remediation: upgrade to GNUBoard 4.34.21 or apply the provided patch. Public re...
CVE-2005-0269
The CVE-2005-0269 vulnerability affects GNUBoard versions 3.40 and earlier, where a file extension check only validates lowercase-letter extensions. This allows remote attackers to upload arbitrary files by using file extensions that contain uppercase letters. The root cause is a case-sensitive c...
CVE-2018-15584
CVE-2018-15584 is an XSS vulnerability in gnuboard5 prior to 5.3.1.6. The issue affects the administrative components adm/boardgroup_form_update.php and adm/boardgroup_list_update.php, where user-supplied input can be injected as script/HTML. This vulnerability is exploitable by remote attackers ...
CVE-2020-18661
GNUBOARD5 contains a Cross-Site Scripting (XSS) vulnerability in versions
CVE-2025-7786
CVE-2025-7786 affects Gnuboard g6 up to version 6.0.10. The issue is a cross-site scripting vulnerability in the Post Reply Handler, triggered by processing the file path /bbs/scrap_popin_update/qa/. The attack can be carried out remotely and the exploit has been disclosed publicly. Connected sou...
CVE-2018-18676
GNUBOARD5 5.3.1.9 contains a cross‑site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML through the mobile board tail contents parameter (adm/board_form_update.php bo_mobile_content_tail). This CVE (CVE-2018-18676) affects GNUBOARD5; exploitation details...
CVE-2009-0290
CVE-2009-0290 concerns a directory traversal in SIR GNUBoard 4.31.03, where an attacker can use a .. in the g4_path parameter to include and execute local files. The vulnerability allows potential remote code execution via data: URIs or UNC paths in certain environments. Affected software is GNUB...
CVE-2018-15581
The CVE-2018-15581 entry concerns gnuboard5: Cross-Site Scripting (XSS) in adm/faqmasterformupdate.php prior to version 5.3.1.6. The PT-2019-9127 document provides explicit affected versions and remediation: gnuboard5 versions before 5.3.1.6 are vulnerable due to an XSS in adm/faqmasterformupdate...
CVE-2020-18663
CVE-2020-18663 affects gnuboard5 in versions prior to or up to 5.3.2.8, with a cross-site scripting (XSS) vulnerability exploitable via the act parameter in bbs/move_update.php. The root cause is an inadequate sanitization/encoding of user-controlled input, enabling injected scripts to execute in...
CVE-2024-37657
The application gnuboard5 version 5.5.16 is susceptible to an open redirect vulnerability within the bbs/login.php component. The root cause is the insufficient validation of URL parameters , which can be exploited by a remote attacker to obtain sensitive information . To mitigate this risk, user...
CVE-2018-15582
CVE-2018-15582 is a Cross-Site Scripting (XSS) vulnerability in gnuboard5, affecting adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php on versions before 5.3.1.6. The issue allows remote attackers to inject arbitrary web script or HTML. The connected PT-2019-9128 entry confir...
CVE-2018-18669
GNUBOARD5 5.3.1.9 is vulnerable to Cross-Site Scripting (XSS) via the board title contents parameter (adm/board_form_update.php bo_subject). Several sources (NVD, Red Hat CVE entry, CNVD) describe this XSS in GNUBOARD5 5.3.1.9 without specifying an exploit. The root cause is insufficient validati...
CVE-2018-18671
GNUBOARD5 5.3.1.9 contains a Cross-Site Scripting vulnerability due to lack of validation in the bo_mobile_content_head parameter (adm/board_form_update.php). The issue enables remote attackers to inject arbitrary script via the mobile board head contents field. CVSS metrics indicate MEDIUM sever...
CVE-2018-18673
GNUBOARD5 5.3.1.9 contains a Cross‑Site Scripting (XSS) flaw in the adm/menu_list_update.php me_link parameter (Menu Link). This allows remote attackers to inject arbitrary web script/HTML. Public details consistently reference the same vulnerability across multiple feeds; no exploit specifics ar...
CVE-2018-18675
GNUBOARD5 5.3.1.9 contains a cross-site scripting (XSS) vulnerability in the adm/board_form_update.php endpoint via the bo_mobile_subject (mobile board title contents) parameter. The issue arises from insufficient input validation in the web application, allowing remote attackers to inject arbitr...
CVE-2018-18672
GNUBOARD5 5.3.1.9 contains an XSS vulnerability in the adm/board_form_update.php endpoint via the board head contents (bo_content_head) parameter, allowing remote script execution in a victim’s browser. The issue is confirmed across multiple sources (Red Hat, CNVD, NVD, osv) and is tied to GNUBOA...
CVE-2018-18678
GNUBOARD5 before 5.3.2.0 is vulnerable to a stored/reflected-like XSS via the board group extra contents parameter in adm/boardgroup_form_update.php (gr_1~10). The issue affects GNUBOARD5 versions prior to 5.3.2.0 and can allow remote attackers to inject arbitrary scripts or HTML that execute in ...
CVE-2018-18670
CVE-2018-18670 affects GNUBOARD5 version 5.3.1.9, where an XSS vulnerability exists allowing remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter (also identified as the adm/config_form_update.php cf_1~10 parameter). The issue stems from insufficient validati...
CVE-2018-15580
GnuBoard5’s adm/contentformupdate.php is affected by a Cross-Site Scripting (XSS) vulnerability in versions prior to 5.3.1.6. The issue allows remote attackers to inject arbitrary web script or HTML. According to PT-2019-9126, affected software is Gnuboard5 before 5.3.1.6, with a suggested fix to...
CVE-2018-15583
GNUBOARD5 (web forum, PHP/MySQL) contains a Cross-Site Scripting (XSS) flaw in point_list.php, exploitable via the popup title parameter. Affected versions are prior to 5.3.1.6. The vulnerability could allow remote attackers to execute arbitrary web script/HTML. Remediation: upgrade to GNUBOARD5 ...
CVE-2018-15585
GNUBOARD5 before 5.3.1.6 is affected by an XSS in newwinform.php via the popup title parameter. The issue enables remote attackers to inject arbitrary script/HTML in web pages. Affected product: GNUBOARD5; vulnerable component: newwinform.php (popup title). Root cause is unvalidated input in the ...
CVE-2018-18674
CVE-2018-18674 affects GNUBOARD5 5.3.1.9, where an XSS flaw exists in the web interface via the board tail contents parameter (adm/board_form_update.php bo_content_tail). The underlying issue is a reflected/stored XSS vector in the bo_content_tail input that can be exploited by remote attackers t...
CVE-2024-37656
Gnuboard5 version 5.5.16 is susceptible to an open redirect vulnerability caused by insufficient URL parameter verification in the bbs/logout.php endpoint. A remote attacker can exploit this by providing a crafted URL parameter to redirect users to arbitrary malicious sites, which may lead to phi...
CVE-2024-37658
An open redirect vulnerability exists in gnuboard5 v.5.5.16 . The flaw stems from insufficient validation of URL parameters within the bbs/member_confirm.php endpoint. A remote attacker can exploit this to obtain sensitive information . As a mitigation, it is recommended to restrict access to the...
CVE-2025-60859
Gnuboard version 5.6.15 is vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the incorrect manipulation of the c_id parameter within the bbs/view_comment.php file. This allows authenticated attackers to execute arbitrary code via a crafted request. To remediate this issu...