PH
Product
phpBB
44
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 11Medium 11Low 0
Watch
Add phpBB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48611 | 9.8 | Jun 12 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default… Affected: 3.3.0 through 3.3.16 |
| CVE-2025-70810 | 8.8 | Apr 9 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism Affected: 3.3.15 |
| CVE-2019-16993 | 8.8 | Sep 30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel Affected: through 3.1.7 |
| CVE-2001-1471 | 8.8 | Jul 31 | prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock… Affected: through 1.4.0 |
| CVE-2026-87901 New | 8.3 | Oct 23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting Affected: 3.3.0 through 3.3.18 |
| CVE-2026-29199 | 8.1 | May 4 | phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning Affected: 3.0.0 through 3.3.15 |
| CVE-2026-48612 | 8.0 | Jun 12 | Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an… Affected: 3.3.0 through 3.3.16 |
| CVE-2019-16108 | 7.5 | Mar 20 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode Affected: 3.2.7 |
| CVE-2019-9826 | 7.5 | May 2 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service Affected: through 3.2.5 |
| CVE-2017-1000419 | 7.5 | Jan 2 | phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially… Affected: 3.2.0 |
| CVE-2026-47366 | 7.2 | Jun 12 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions… Affected: 3.3.0 through 3.3.16 |
| CVE-2018-19274 | 7.2 | Nov 17 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has… Affected: before 3.2.4 |
| CVE-2020-5502 | 6.5 | Jan 15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships Affected: 3.2.8 |
| CVE-2019-13376 | 6.5 | Sep 27 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature Affected: 3.2.7 |
| CVE-2023-5917 | 6.1 | Nov 2 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10 Affected: before 3.3.11 |
| CVE-2011-0544 | 6.1 | Nov 14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag Affected: 3.0.0 through 3.0.6 |
| CVE-2015-3880 | 6.1 | Sep 19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing… Affected: through 3.0.14; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +17 more |
| CVE-2026-48613 | 5.9 | Jun 12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL… Affected: 3.3.8 through 3.3.16 |
| CVE-2020-8226 | 5.8 | Aug 17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF Affected: before 3.2.10; 3.3.0 before 3.3.1 |
| CVE-2019-11767 | 5.8 | May 5 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload… Affected: before 3.2.6 |
| CVE-2025-70811 | 4.3 | Apr 9 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality Affected: 3.3.15 |
| CVE-2019-16107 | 4.3 | Mar 11 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments Affected: 3.2.7 |
| CVE-2020-5501 | 4.3 | Jan 15 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar Affected: 3.2.8 |
| CVE-2015-1432 | – | Feb 10 | The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF… Affected: through 3.0.12 |
| CVE-2015-1431 | – | Feb 10 | Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to… Affected: through 3.0.12 |
| CVE-2010-1630 | – | May 19 | Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global… Affected: through 3.0.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +7 more |
| CVE-2010-1627 | – | May 19 | feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack… Affected: 3.0.7 |
| CVE-2008-7143 | – | Sep 1 | phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post… Affected: 2.0.23 |
| CVE-2008-6507 | – | Mar 23 | Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3 |
| CVE-2008-6506 | – | Mar 23 | Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors Affected: through 3.0.3; 1.0; 2.0; 2.0.1; 2.0.2; 2.0.3; +13 more |
| CVE-2008-4125 | – | Sep 18 | The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as… Affected: 2 |
| CVE-2008-3224 | – | Jul 18 | Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()." Affected: through 3.0.1; 3.0; 3.0; 3.0; 3.0; 3.0; +3 more |
| CVE-2008-1766 | – | Apr 12 | Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs." Affected: through 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +2 more |
| CVE-2008-0471 | – | Jan 29 | Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action Affected: 2.0.22 |
| CVE-2007-5688 | – | Oct 29 | Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow… Affected: All versions, or not specified |
| CVE-2007-5173 | – | Oct 3 | PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the… Affected: All versions, or not specified |
| CVE-2007-4653 | – | Sep 4 | SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and earlier allows remote attackers to execute arbitrary SQL commands via the start… Affected: through 2.0.22 |
| CVE-2006-7168 | – | Mar 20 | PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL in the… Affected: All versions, or not specified |
| CVE-2006-2220 | – | Feb 8 | phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive information via a negative… Affected: 2.0.20 |
| CVE-2007-0762 | – | Feb 6 | PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path… Affected: build_100 |
| CVE-2006-5191 | – | Oct 10 | PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute… Affected: through 1.0 |
| CVE-2003-1530 | – | Dec 31 | SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter Affected: 2.0.3 |
| CVE-2002-2346 | – | Dec 31 | phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses Affected: 2.0; 2.0.1; 2.0.2; 2.0.3 |
| CVE-2002-2255 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the… Affected: 2.0.3 |
Showing 44