CVE-2008-1484
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on...
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
Exploit likelihood
What each source reports
NVD Score used
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
- Record
CVE-2008-1484- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
- Record
CVE-2008-1484- Updated
- 2026-11-02
EUVDEUVD-2008-1486 No score
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
- Record
EUVD-2008-1486- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q3j2-cxwr-pv75 No score
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on...
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
- Record
GHSA-q3j2-cxwr-pv75- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PunBB 1.2.16 - Blind Password Recovery | 2008-02-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1484 is a low vulnerability (CVSS 3.5) in Punbb, published March 24, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.52%, the 91st percentile. No source names a fixed version.