CVE-2018-18668

GNUBOARD5 before 5.3.2.0 is affected by a cross-site scripting (XSS) vulnerability in the homepage title parameter (adm/config_form_update.php cf_title). Exploitation allows remote attackers to inject arbitrary web script/HTML, potentially compromising user sessions and browser execution context....

CVE-2022-1252

CVE-2022-1252 concerns gnuboard/gnuboard5 (versions up to and including 5.5.5). The vulnerability stems from the use of a broken or risky cryptographic algorithm, allowing an attacker to derive a user’s email address and potentially send emails to arbitrary addresses with full content control. Ro...

CVE-2022-44216

Gnuboard versions 5.5.4 and 5.5.5 are reported vulnerable to an insecure permissions issue that lets an attacker change the password of all users without knowing any victim’s password. The provided documents consistently describe this vulnerability as an account-management/privilege-control flaw ...

CVE-2024-24157

Gnuboard g6 is affected by CVE-2024-24157 due to a Cross Site Scripting (XSS) flaw in board.py stemming from commit c2cc1f5069e00491ea48618d957332d90f6d40e4. The vulnerability is described consistently across sources (NVD, Red Hat, OSV, CVE List, CVE.org, CNVD, VulnEnrichment, PT Security). Explo...

CVE-2022-30050

CVE-2022-30050 affects Gnuboard versions 5.55 and 5.56, with a Cross-Site Scripting (XSS) flaw in the file path bbs/member_confirm.php . The root cause is insufficient validation/output handling of user-supplied data, enabling script execution on the client side. Reported by multiple sources (CNV...

CVE-2024-41475

CVE-2024-41475 affects Gnuboard g6 6.0.7. Vulnerable due to a misconfigured CORS policy that can enable session hijacking, potentially exposing user sessions (high/critical impact per sources). Remediation: fix CORS configuration to properly restrict cross-origin access; consider restricting acce...

CVE-2014-2339

CVE-2014-2339 concerns GNUboard 5.x (and possibly earlier) with multiple SQL injection vulnerabilities in the file bbs/ajax.autosave.php . The flaws allow remote authenticated users to execute arbitrary SQL commands via the parameters subject or content . Exploitation is documented in multiple so...

CVE-2020-18662

Gnuboard5

CVE-2022-3963

CVE-2022-3963 affects gnuboard5, targeting the FAQ Key ID Handler in file bbs/faq.php. The issue is a cross-site scripting (XSS) vulnerability caused by manipulating the fm_id parameter, enabling remote exploitation. A fix is available in version 5.5.8.2.1, with patch identifier ba062ca5b62809106...

CVE-2004-1403

CVE-2004-1403 affects GNUBoard ≤3.39; a PHP remote file inclusion in index.php via the doc parameter lets an attacker reference a URL on a remote server to execute arbitrary PHP code. The issue is a remote inclusion flaw enabling code execution with web server privileges; connected Nessus/SIR ent...

CVE-2024-24156

CVE-2024-24156: Cross Site Scripting (XSS) in Gnuboard g6 prior to commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5 allows remote attackers to execute arbitrary code via the wr_content parameter. Affected product: Gnuboard g6 (before the cited commit). Root cause: XSS in wr_content parameter. Impa...

CVE-2024-39097

Gnuboard v6.0.4 and earlier is affected by an Open Redirect in the login path via the url parameter. Root cause: improper validation/tainting of the login URL leads to redirection to an attacker-controlled site. Impact: user could be redirected to malicious sites (CVSS: 6.1, MEDIUM; network vecto...

CVE-2011-4066

Gnuboard 4.33.02 and earlier contains a PATH_INFO-based SQL injection in bbs/tb.php that allows remote attackers to execute arbitrary SQL commands. Multiple sources (NVD entry CVE-2011-4066, Seebug/Exploit-DB listings) document this vulnerability and provide exploit examples, indicating that expl...

CVE-2018-15584

CVE-2018-15584 is an XSS vulnerability in gnuboard5 prior to 5.3.1.6. The issue affects the administrative components adm/boardgroup_form_update.php and adm/boardgroup_list_update.php, where user-supplied input can be injected as script/HTML. This vulnerability is exploitable by remote attackers ...

CVE-2005-0269

The CVE-2005-0269 vulnerability affects GNUBoard versions 3.40 and earlier, where a file extension check only validates lowercase-letter extensions. This allows remote attackers to upload arbitrary files by using file extensions that contain uppercase letters. The root cause is a case-sensitive c...

CVE-2012-4873

GNUBoard is vulnerable to an XSS in the file_download function via the filename parameter, affecting versions before 4.34.21. The root cause is improper handling of the filename input leading to script/HTML injection. Remediation: upgrade to GNUBoard 4.34.21 or apply the provided patch. Public re...

CVE-2018-18676

GNUBOARD5 5.3.1.9 contains a cross‑site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML through the mobile board tail contents parameter (adm/board_form_update.php bo_mobile_content_tail). This CVE (CVE-2018-18676) affects GNUBOARD5; exploitation details...

CVE-2009-0290

CVE-2009-0290 concerns a directory traversal in SIR GNUBoard 4.31.03, where an attacker can use a .. in the g4_path parameter to include and execute local files. The vulnerability allows potential remote code execution via data: URIs or UNC paths in certain environments. Affected software is GNUB...

CVE-2018-15581

The CVE-2018-15581 entry concerns gnuboard5: Cross-Site Scripting (XSS) in adm/faqmasterformupdate.php prior to version 5.3.1.6. The PT-2019-9127 document provides explicit affected versions and remediation: gnuboard5 versions before 5.3.1.6 are vulnerable due to an XSS in adm/faqmasterformupdate...

CVE-2018-18669

GNUBOARD5 5.3.1.9 is vulnerable to Cross-Site Scripting (XSS) via the board title contents parameter (adm/board_form_update.php bo_subject). Several sources (NVD, Red Hat CVE entry, CNVD) describe this XSS in GNUBOARD5 5.3.1.9 without specifying an exploit. The root cause is insufficient validati...

CVE-2020-18661

GNUBOARD5 contains a Cross-Site Scripting (XSS) vulnerability in versions

CVE-2018-18671

GNUBOARD5 5.3.1.9 contains a Cross-Site Scripting vulnerability due to lack of validation in the bo_mobile_content_head parameter (adm/board_form_update.php). The issue enables remote attackers to inject arbitrary script via the mobile board head contents field. CVSS metrics indicate MEDIUM sever...

CVE-2020-18663

CVE-2020-18663 affects gnuboard5 in versions prior to or up to 5.3.2.8, with a cross-site scripting (XSS) vulnerability exploitable via the act parameter in bbs/move_update.php. The root cause is an inadequate sanitization/encoding of user-controlled input, enabling injected scripts to execute in...

CVE-2018-18673

GNUBOARD5 5.3.1.9 contains a Cross‑Site Scripting (XSS) flaw in the adm/menu_list_update.php me_link parameter (Menu Link). This allows remote attackers to inject arbitrary web script/HTML. Public details consistently reference the same vulnerability across multiple feeds; no exploit specifics ar...

CVE-2018-15582

CVE-2018-15582 is a Cross-Site Scripting (XSS) vulnerability in gnuboard5, affecting adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php on versions before 5.3.1.6. The issue allows remote attackers to inject arbitrary web script or HTML. The connected PT-2019-9128 entry confir...

CVE-2018-15585

GNUBOARD5 before 5.3.1.6 is affected by an XSS in newwinform.php via the popup title parameter. The issue enables remote attackers to inject arbitrary script/HTML in web pages. Affected product: GNUBOARD5; vulnerable component: newwinform.php (popup title). Root cause is unvalidated input in the ...

CVE-2018-18672

GNUBOARD5 5.3.1.9 contains an XSS vulnerability in the adm/board_form_update.php endpoint via the board head contents (bo_content_head) parameter, allowing remote script execution in a victim’s browser. The issue is confirmed across multiple sources (Red Hat, CNVD, NVD, osv) and is tied to GNUBOA...

CVE-2018-18675

GNUBOARD5 5.3.1.9 contains a cross-site scripting (XSS) vulnerability in the adm/board_form_update.php endpoint via the bo_mobile_subject (mobile board title contents) parameter. The issue arises from insufficient input validation in the web application, allowing remote attackers to inject arbitr...

CVE-2018-18678

GNUBOARD5 before 5.3.2.0 is vulnerable to a stored/reflected-like XSS via the board group extra contents parameter in adm/boardgroup_form_update.php (gr_1~10). The issue affects GNUBOARD5 versions prior to 5.3.2.0 and can allow remote attackers to inject arbitrary scripts or HTML that execute in ...

CVE-2018-15580

GnuBoard5’s adm/contentformupdate.php is affected by a Cross-Site Scripting (XSS) vulnerability in versions prior to 5.3.1.6. The issue allows remote attackers to inject arbitrary web script or HTML. According to PT-2019-9126, affected software is Gnuboard5 before 5.3.1.6, with a suggested fix to...

CVE-2018-15583

GNUBOARD5 (web forum, PHP/MySQL) contains a Cross-Site Scripting (XSS) flaw in point_list.php, exploitable via the popup title parameter. Affected versions are prior to 5.3.1.6. The vulnerability could allow remote attackers to execute arbitrary web script/HTML. Remediation: upgrade to GNUBOARD5 ...

CVE-2018-18674

CVE-2018-18674 affects GNUBOARD5 5.3.1.9, where an XSS flaw exists in the web interface via the board tail contents parameter (adm/board_form_update.php bo_content_tail). The underlying issue is a reflected/stored XSS vector in the bo_content_tail input that can be exploited by remote attackers t...

CVE-2018-18670

CVE-2018-18670 affects GNUBOARD5 version 5.3.1.9, where an XSS vulnerability exists allowing remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter (also identified as the adm/config_form_update.php cf_1~10 parameter). The issue stems from insufficient validati...

CVE-2024-37656

CVE-2024-37656 affects Gnuboard5 5.5.16. The vulnerability is an open redirect caused by insufficient URL parameter verification in bbs/logout.php , allowing remote attackers to redirect users to arbitrary URLs when a crafted URL parameter is supplied. Exploitation details are not universally des...

CVE-2025-7786

CVE-2025-7786 affects Gnuboard g6 up to version 6.0.10. The issue is a cross-site scripting vulnerability in the Post Reply Handler, triggered by processing the file path /bbs/scrap_popin_update/qa/. The attack can be carried out remotely and the exploit has been disclosed publicly. Connected sou...

CVE-2024-37657

The CVE-2024-37657 entry concerns gnuboard5 v5.5.16 with an open redirect in the bbs/login.php component caused by insufficient validation of URL parameters. Exploitation could allow a remote attacker to obtain sensitive information and potentially disorient users by redirecting to an attacker-co...

CVE-2024-37658

CVE-2024-37658 affects gnuboard5 v5.5.16. The open redirect is caused by insufficient validation of URL parameters in bbs/member_confirm.php, enabling an attacker to obtain sensitive information. Affected component: bbs/member_confirm.php; root cause: URL parameter validation flaw. Exploitation d...

CVE-2025-61464

CVE-2025-61464 affects gnuboard4 v4.36.04 and earlier. The root cause is a Second-order SQL Injection via the search_table in bbs/search.php. Documented impacts include possible unauthorized database access or modification. Remediation recommended in multiple sources is to upgrade to gnuboard ver...

CVE-2025-60859

Gnuboard 5.6.15 is affected by CVE-2025-60859 due to an XSS vulnerability in bbs/view_comment.php caused by crafted c_id parameter. Authenticated attackers can exploit this to execute arbitrary code. Multiple sources (NVD, Red Hat, ENISA EUVD, OSV, CNNVD, CVE list) corroborate the XSS impact. No ...