Phpbb

Phpbb

35 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2023-5917

  • EPSS 0.09%
  • Published 02.11.2023 11:15:14
  • Last modified 21.11.2024 08:42:46

A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak l...

5.8

CVE-2020-8226

  • EPSS 0.18%
  • Published 17.08.2020 16:15:13
  • Last modified 21.11.2024 05:38:32

A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.

7.5

CVE-2019-16108

  • EPSS 0.25%
  • Published 20.03.2020 00:17:09
  • Last modified 21.11.2024 04:30:03

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

4.3

CVE-2019-16107

  • EPSS 0.09%
  • Published 11.03.2020 13:15:11
  • Last modified 21.11.2024 04:30:03

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.

6.5

CVE-2020-5502

  • EPSS 0.1%
  • Published 15.01.2020 00:15:13
  • Last modified 21.11.2024 05:34:10

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

4.3

CVE-2020-5501

  • EPSS 0.1%
  • Published 15.01.2020 00:15:13
  • Last modified 21.11.2024 05:34:10

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.

6.1

CVE-2011-0544

  • EPSS 0.34%
  • Published 14.11.2019 00:15:10
  • Last modified 21.11.2024 01:24:15

phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.

8.8

CVE-2019-16993

  • EPSS 0.22%
  • Published 30.09.2019 12:15:10
  • Last modified 21.11.2024 04:31:30

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a re...

6.5

CVE-2019-13376

Exploit
  • EPSS 0.16%
  • Published 27.09.2019 13:15:10
  • Last modified 21.11.2024 04:24:49

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

5.8

CVE-2019-11767

  • EPSS 0.22%
  • Published 05.05.2019 06:29:00
  • Last modified 21.11.2024 04:21:45

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.