CVE-2000-0853

YaBB Bulletin Board vulnerability (CVE-2000-0853) affects YaBB.pl: an input validation flaw in the file parameter (num) allows remote attackers to read arbitrary server files via path traversal (e.g., ../../../../../../../../etc/passwd%00) and the .txt suffix handling. This enables reading files ...

CVE-2005-4426

CVE-2005-4426 involves YaBB before 2.1 where an interpretation conflict allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF extension, causing the HTML to execute in Internet Explorer (as described for CVE-2005-3312). The issue is tied to YaBB’s ...

CVE-2004-0344

YaBB SE 1.5.4–1.5.5b contains a directory traversal vulnerability in ModifyMessage.php, exploitable with an attached Old parameter to delete arbitrary files via .. path component. Impact: remote attacker could remove files on the affected host. Root cause is improper validation of the attachOld p...

CVE-2005-0785

CVE-2005-0785 describes a cross-site scripting (XSS) vulnerability in YaBB 2.0 rc1, specifically in the YaBB.pl usersrecentposts action. The issue arises from unsafely handling the username parameter, allowing an attacker to inject arbitrary web script or HTML that could run in a victim’s browser...

CVE-2000-1176

CVE-2000-1176 describes a directory-traversal vulnerability in YaBB’s search.pl CGI script, permitting remote attackers to read arbitrary files by abusing a .. (dot dot) input in the catsearch form field. The issue is documented for YaBB SE configurations, including references to older plugins th...

CVE-2002-0955

CVE-2002-0955 describes a cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier. An attacker can supply a malicious script via the num parameter, which is not filtered in the resulting error message, allowing the script to run in the context o...

CVE-2004-2402

CVE-2004-2402 affects YaBB 1 GOLD SP 1.3.2. YaBB.pl CGI is vulnerable to cross-site scripting via a hex-encoded to parameter; note that some sources claimed the board parameter is affected, but this is stated as incorrect in the primary description. Connected sources corroborate multiple vulnerab...

CVE-2007-3208

CRLF injection vulnerability in YaBB 2.1 allows remote attackers to obtain administrative access through requests to register.pl or profile.pl that write CRLF sequences to a .vars file; this may enable execution of arbitrary code. No patch/version details are provided in the supplied documents.

CVE-2002-1846

YaBB vulnerable: YaBB 1.40/1.41 allows changing a user’s password without providing the correct password, by leveraging a stolen cookie and submitting a profile2 action to index.php. This lets remote attackers modify the password and adjust the expiretime setting. Root cause is insufficient authe...

CVE-2006-4157

CVE-2006-4157: A Cross-site scripting (XSS) vulnerability in index.php of Yet another Bulletin Board (YaBB) allows remote attackers to inject arbitrary web script or HTML via the categories parameter. The NVD entry lists a CVSSv2 base score of 6.8 (MEDIUM) with Network attack vector, user interac...

CVE-2004-2139

CVE-2004-2139 affects YaBB 1 Gold prior to 1.3.2. The vulnerability is described as an arbitrary code execution via the settings.pl path in Adminedit.pl, indicating a remote attacker could leverage this in the YaBB 1 Gold web forum software. Affected component/file: YaBB 1 Gold

CVE-2007-3295

YaBB 2.1 and earlier suffer a directory traversal vulnerability where remote authenticated users can execute arbitrary Perl code by manipulating the userlanguage profile setting; the userlanguage key is propagated to language variables across multiple YaBB scripts (HelpCentre.pl, ICQPager.pl, Sub...

CVE-2002-2296

The CVE-2002-2296 entry describes a Cross-site scripting (XSS) vulnerability in YaBB.pl used by Yet Another Bulletin Board (YaBB) 1 Gold SP 1 . The flaw allows remote attackers to inject arbitrary web script or HTML through the num parameter . The available connected documents reiterate this desc...

CVE-2005-2296

CVE-2005-2296 affects YabbSE 1.5.5c. The vulnerability allows remote attackers to obtain sensitive information by directly requesting ssi_examples.php, which reveals the installation path. Public details in the provided documents do not specify affected versions beyond 1.5.5c, nor do they describ...

CVE-2006-3275

CVE-2006-3275 affects YaBB SE 1.5.5 and earlier, with a SQL injection in profile.php via a double-encoded user parameter in the viewprofile action. The underlying issue is a lack of proper input handling that allows remote attackers to execute SQL commands. Documented impact includes potential da...

CVE-2004-1827

CVE-2004-1827 is an XSS vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final. The issue allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags. Affected software is YaBBForum components mentioned in the CVE record, with the vul...

CVE-2003-0275

Vulnerability: YaBB SE 1.5.2’s SSI.php is exploitable via the sourcedir parameter, allowing remote attackers to reference a URL containing PHP code and execute it on the affected server. Impact: Partial confidentiality, integrity, and availability per CVSS 2.0 base metrics (5.1). Details: No expl...

CVE-2004-0343

The CVE-2004-0343 entry concerns YaBB SE 1.5.4 through 1.5.5b, where multiple SQL injection flaws enable remote attackers to execute arbitrary SQL. The vulnerable vectors are in ModifyMessage.php via the msg parameter and via the postid parameter. Impact is described as complete confidentiality, ...

CVE-2004-2140

CVE-2004-2140 describes a CRLF injection in YaBB 1 Gold before 1.3.2, where an attacker can modify text file contents via the subject parameter. Affected product: YaBB 1 Gold web forum software (pre-1.3.2). Root cause: input handling allows CRLF injection in the subject field, enabling unauthoriz...

CVE-2004-2403

CVE-2004-2403 describes a CSRF vulnerability in YaBB 1 GOLD SP 1.3.2. An attacker can cause the administrative user to perform unauthorized actions by enticing the admin to click a crafted link or view an IMG tag that targets YaBB.pl with specific action, id, and moda parameters. The vulnerabilit...

CVE-2004-1982

CVE-2004-1982 affects YaBB 1 Gold SP 1.2, where Post.pl allows remote attackers to modify records in the board’s .txt file by sending carriage return characters in the subject field. The available documents describe the vulnerability and impact as modification of board records, but do not provide...

CVE-2005-0741

YaBB.pl (YaBB 2.0 RC1) contains a cross-site scripting (XSS) flaw in the usersrecentposts action via the username parameter. The vulnerability results in arbitrary script/HTML execution in a user’s browser within the context of the affected site. Documented in CVE-2005-0741 with details from NVD/...

CVE-2003-1277

CVE-2003-1277 describes cross-site scripting (XSS) in YaBB 1.5.0. The vulnerability allows remote attackers to execute arbitrary scripts as other users and potentially steal authentication information via cookies by injecting HTML/script into (1) news_icon of news_template.php and (2) threadid an...

CVE-2004-0291

CVE-2004-0291 describes an SQL injection in YaBB SE 1.5.4 and 1.5.5 via post.php, allowing remote attackers to obtain hashed passwords through the quote parameter. The affected software is YaBB SE (older forum software); root cause is unvalidated input used in a SQL query. Impact stated or implie...

CVE-2013-2057

YaBB through 2.5.2 is affected by a Local File Include vulnerability caused by the 'guestlanguage' cookie parameter, enabling inclusion of local files due to improper handling of the cookie value. Affected product/component: YaBB (web forum) up to version 2.5.2. Root cause: unsanitized cookie par...

CVE-2002-0117

The CVE-2002-0117 entry concerns YaBB (Yet Another Bulletin Board) 1 Gold SP 1 and earlier, where a cross-site scripting vulnerability allows remote attackers to execute arbitrary script and steal cookies through a message containing encoded Javascript in an IMG tag. Affected component is the YaB...

CVE-2002-1845

CVE-2002-1845 is an XSS vulnerability in Yet Another Bulletin Board (YaBB) versions 1.40 and 1.41, where the password parameter (passwrd) can be exploited by remote attackers to inject arbitrary web script/HTML via index.php. The connected sources confirm the affected product/version and the vuln...