PH
Product
phpBB
44
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 11Medium 11Low 0
Watch
Add phpBB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5502 | 6.5 | Jan 15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships Affected: 3.2.8 |
| CVE-2019-13376 | 6.5 | Sep 27 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature Affected: 3.2.7 |
| CVE-2023-5917 | 6.1 | Nov 2 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10 Affected: before 3.3.11 |
| CVE-2011-0544 | 6.1 | Nov 14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag Affected: 3.0.0 through 3.0.6 |
| CVE-2015-3880 | 6.1 | Sep 19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing… Affected: through 3.0.14; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +17 more |
| CVE-2026-48613 | 5.9 | Jun 12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL… Affected: 3.3.8 through 3.3.16 |
| CVE-2020-8226 | 5.8 | Aug 17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF Affected: before 3.2.10; 3.3.0 before 3.3.1 |
| CVE-2019-11767 | 5.8 | May 5 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload… Affected: before 3.2.6 |
| CVE-2025-70811 | 4.3 | Apr 9 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality Affected: 3.3.15 |
| CVE-2019-16107 | 4.3 | Mar 11 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments Affected: 3.2.7 |
| CVE-2020-5501 | 4.3 | Jan 15 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar Affected: 3.2.8 |
Showing 11