CVE-2006-2568

UBB.threads vulnerability CVE-2006-2568 is a remote file inclusion in addpost_newpoll.php, where the thispath parameter is consumed by PHP include() without proper sanitization. Affected versions are UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial). Exploitation can enable an attacker to view ar...

CVE-2006-5137

CVE-2006-5137 affects Groupee UBB.threads 6.5.1.1 and enables remote PHP code injection through multiple vectors: (1) theme[] via admin/doedittheme.php into includes/theme.inc.php; (2) config[] via admin/doeditconfig.php into includes/config.inc.php; and (3) a URL in config[path] exploited to run...

CVE-2005-2060

Infopop UBB.Threads (before 6.5.2 Beta) is affected by HTTP Response Splitting in three scripts (toggleshow.php, togglecats.php, showprofile.php) via CRLF sequences in the Cat parameter. Root cause: insufficient input validation leads to remote spoofing of content and potential web-cache poisonin...

CVE-2006-5138

CVE-2006-5138 affects Groupee UBB.threads 6.5.1.1. The vulnerability allows remote attackers to obtain sensitive information via a direct request to cron/php/subscriptions.php, which reveals the installation path in an error message. This is a information disclosure issue reported in multiple sou...

CVE-2006-2675

The CVE-2006-2675 entry concerns PHP remote file inclusion in the UBBThreads product (versions 5.x and 6.x). The vulnerability arises from using unsanitized input in the thispath and configdir parameters of ubbt.inc.php, allowing an attacker to cause arbitrary PHP code execution by supplying a cr...

CVE-2005-2061

CVE-2005-2061 affects Infopop UBB.Threads prior to 6.5.2 Beta. The issue is a remote file inclusion via the language parameter stored in a cookie, followed by a null (%00) byte, enabling an attacker to include arbitrary files. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network ...

CVE-2006-1423

CVE-2006-1423 corresponds to a SQL injection vulnerability in showflat.php of UBB.threads (versions 5.5.1, 6.0 br5, 6.0.1, 6.0.2 and earlier). The issue allows remote attackers to inject arbitrary SQL through the Number parameter, enabling potential unauthorized database access. Connected sources...