CVE-2001-1471
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP...
CVE-2001-1471 is a high vulnerability (CVSS 8.8) in Phpbb, published July 31, 2001. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.70%, the 94th percentile. No source names a fixed version.
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
- Record
CVE-2001-1471- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-665
- Updated
- 2026-11-02
CVE List No score
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
- Record
CVE-2001-1471- Updated
- 2026-11-02
EUVDEUVD-2001-1451 No score
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
- Record
EUVD-2001-1451- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxf9-rgcc-942c
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP...
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
- Record
GHSA-xxf9-rgcc-942c- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-665
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | phpBB 1.x - Page Header Arbitrary Command Execution | 2001-07-31 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.html
archives.neohapsis.com/archives/bugtraq/2001-08/0123.html
exchange.xforce.ibmcloud.com/vulnerabilities/6944
kb.cert.org/vuls/id/920931
securityfocus.com/bid/3167
nvd.nist.gov/vuln/detail/CVE-2001-1471
github.com/advisories/GHSA-xxf9-rgcc-942c