Phpbb Phpbb vulnerabilities

• phpbb Improper sanitization in the registration module allows reflected Cross-Site Scripting. CVE-2026-87901 8.3 HighOctober 23, 2026
• phpbb SQL injection vulnerability in phpBB profile field migration due to improper handling of user... CVE-2026-48613 7.1 HighJune 12, 2026
• phpbb Improper state verification in the OAuth implementation could allow an attacker to manipulate the... CVE-2026-48612 8.0 HighJune 12, 2026
• phpbb Improper authentication checks in the OAuth implementation allow account hijacking even when... CVE-2026-48611 Public exploit 9.8 CriticalJune 12, 2026
• phpbb Improper verification of access permissions when modifying permissions through the Administration... CVE-2026-47366 7.2 HighJune 12, 2026
• phpbb phpBB has Password Reset Link Poisoning via Host Header injection CVE-2026-29199 Fix available 8.1 HighMay 4, 2026
• phpbb Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality. CVE-2025-70811 4.3 MediumApril 9, 2026
• phpbb Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism CVE-2025-70810 8.8 HighApril 9, 2026
• phpbb phpBB Smiley Pack acp_icons.php main cross site scripting CVE-2023-5917 Fix available 2.4 LowNovember 2, 2023
• phpbb phpBB Server-Side Request Forgery Vulnerability CVE-2020-8226 Fix available 5.8 MediumAugust 17, 2020
• phpbb phpBB arbitrary CSS injection CVE-2019-16108 Fix available 7.5 HighMarch 19, 2020
• phpbb phpBB Cross-Site Request Forgery (CSRF) CVE-2019-16107 Fix available 4.3 MediumMarch 11, 2020
• phpbb phpBB allows CSRF CVE-2020-5502 Fix available 6.5 MediumJanuary 14, 2020
• phpbb phpBB Cross-Site Request Forgery (CSRF) CVE-2020-5501 Fix available 4.3 MediumJanuary 14, 2020
• phpbb, debian linux, phpbb3 +2 more phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. CVE-2011-0544 6.1 MediumNovember 13, 2019
• phpbb, debian linux +1 more phpBB Cross-Site Request Forgery (CSRF) CVE-2019-16993 Fix available 8.8 HighSeptember 30, 2019
• phpbb phpBB Cross-Site Request Forgery (CSRF) CVE-2019-13376 Fix available 6.5 MediumSeptember 27, 2019
• phpbb phpBB Server side request forgery (SSRF) CVE-2019-11767 Fix available 5.8 MediumMay 5, 2019
• phpbb phpBB Denial of Service CVE-2019-9826 Fix available 7.5 HighMay 2, 2019
• phpbb, debian linux +1 more phpBB Remote Code Execution CVE-2018-19274 Fix available 7.2 HighNovember 17, 2018
• phpbb phpBB Server-Side Request Forgery (SSRF) CVE-2017-1000419 Fix available 7.5 HighJanuary 2, 2018
• phpbb phpBB Open Redirect CVE-2015-3880 Fix available 6.1 MediumSeptember 19, 2017
• phpbb The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not... CVE-2015-1432 Fix available 6.8 MediumFebruary 10, 2015
• phpbb Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows... CVE-2015-1431 Fix available 4.3 MediumFebruary 10, 2015
• phpbb phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement." CVE-2010-1630 Fix available 7.5 HighMay 19, 2010
• phpbb phpBB 3.0.7 allows remote attackers to bypass intended access restrictions CVE-2010-1627 Fix available 4.3 MediumMay 19, 2010
• phpbb phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or... CVE-2008-7143 6.8 MediumSeptember 1, 2009
• phpbb phpBB vulnerable to sensitive information disclosure CVE-2008-6507 Fix available 5.0 MediumMarch 23, 2009
• phpbb Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access... CVE-2008-6506 5.0 MediumMarch 23, 2009
• phpbb The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG,... CVE-2008-4125 5.0 MediumSeptember 18, 2008
• phpbb Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to ... CVE-2008-3224 10.0 HighJuly 18, 2008
• phpbb Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors... CVE-2008-1766 10.0 HighApril 12, 2008
• phpbb Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote... CVE-2008-0471 Fix available 4.3 MediumJanuary 29, 2008
• invision power services power board, phpbb, sebflipper multi-forums module +2 more Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum... CVE-2007-5688 Public exploit 7.5 HighOctober 29, 2007
• openid, phpbb +1 more PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB... CVE-2007-5173 Public exploit 6.8 MediumOctober 3, 2007
• phpbb plus Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922,... CVE-2007-5100 6.8 MediumSeptember 26, 2007
• phpbb SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and... CVE-2007-4653 Public exploit 7.5 HighSeptember 4, 2007
• phpbb PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP... CVE-2006-7168 Public exploit 7.5 HighMarch 20, 2007
• phpbb phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL... CVE-2006-2220 5.0 MediumFebruary 8, 2007
• phpbb PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec... CVE-2006-5191 Public exploit 5.1 MediumOctober 6, 2006
• phpbb SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to... CVE-2003-1530 Public exploit 7.5 HighDecember 31, 2003
• phpbb phpbbmod phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to... CVE-2002-2349 Public exploit 5.0 MediumDecember 31, 2002
• phpbb phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address... CVE-2002-2346 5.0 MediumDecember 31, 2002
• phpbb Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier... CVE-2002-2255 Public exploit 4.3 MediumDecember 31, 2002
• phpbb prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP... CVE-2001-1471 Public exploit 8.8 HighJuly 31, 2001