CVE-2011-3622 | Medium | 6.1 | 2020-01-22 | A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18. |
CVE-2012-6659 | | | 2014-09-19 | Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a cr… |
CVE-2012-4234 | | | 2014-09-04 | Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to… |
CVE-2011-4561 | | | 2011-11-28 | Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admi… |
CVE-2011-3768 | | | 2011-09-24 | Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mes… |
CVE-2011-3392 | | | 2011-09-08 | Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or… |
CVE-2011-3382 | | | 2011-09-08 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2011-3381 | | | 2011-09-08 | Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown… |
CVE-2010-1629 | | | 2010-05-19 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address. |
CVE-2009-0488 | | | 2009-02-09 | Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2008-4513 | | | 2008-10-09 | Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode… |
CVE-2008-1486 | | | 2008-03-24 | SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fullte… |
CVE-2007-2339 | | | 2007-04-27 | Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter… |
CVE-2007-2338 | | | 2007-04-27 | Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist de… |
CVE-2007-2250 | | | 2007-04-25 | admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter. |
CVE-2007-2249 | | | 2007-04-25 | include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or… |
CVE-2007-2248 | | | 2007-04-25 | Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2007-0769 | | | 2007-02-06 | Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vector… |
CVE-2007-0767 | | | 2007-02-06 | Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vec… |
CVE-2006-6968 | | | 2007-02-06 | Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary w… |
CVE-2006-6550 | | | 2006-12-14 | PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_fi… |
CVE-2006-3615 | | | 2006-07-18 | Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via… |
CVE-2006-3612 | | | 2006-07-18 | Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2006-3611 | | | 2006-07-18 | Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal… |
CVE-2006-3249 | | | 2006-06-27 | SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE… |
CVE-2006-3053 | | | 2006-06-16 | PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORU… |
CVE-2005-3543 | | | 2005-11-16 | SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary S… |
CVE-2005-2836 | | | 2005-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the use… |
CVE-2005-0843 | | | 2005-05-02 | CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which i… |
CVE-2005-0784 | | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject l… |
CVE-2005-0783 | | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attache… |
CVE-2004-2243 | | | 2004-12-31 | Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated us… |
CVE-2004-2242 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web scri… |
CVE-2004-2241 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some… |
CVE-2004-2240 | | | 2004-12-31 | Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2)… |
CVE-2004-2110 | | | 2004-12-31 | SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter. |
CVE-2004-1518 | | | 2004-12-31 | SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id para… |
CVE-2004-1938 | | | 2004-04-19 | SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such a… |
CVE-2004-1822 | | | 2004-03-15 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1)… |
CVE-2004-0035 | | | 2004-01-20 | SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter. |
CVE-2004-0034 | | | 2004-01-20 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phoru… |
CVE-2003-1487 | | | 2003-12-31 | Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configurati… |
CVE-2003-1486 | | | 2003-12-31 | Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss… |
CVE-2003-1467 | | | 2003-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote at… |
CVE-2003-1466 | | | 2003-12-31 | Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) lo… |
CVE-2003-1465 | | | 2003-12-31 | Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files. |
CVE-2003-0283 | | | 2003-06-16 | Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "<<"… |
CVE-2002-2340 | | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or… |
CVE-2002-0764 | | | 2002-08-12 | Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHOR… |
CVE-2002-0352 | | | 2002-06-25 | Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which doe… |
CVE-2000-1234 | | | 2000-12-31 | violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and… |
CVE-2000-1233 | | | 2000-12-31 | SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter. |
CVE-2000-1232 | | | 2000-12-31 | upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method. |
CVE-2000-1231 | | | 2000-12-31 | code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string. |
CVE-2000-1230 | | | 2000-12-31 | Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to "boogi… |
CVE-2000-1229 | | | 2000-12-31 | Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences in the default .lang… |
CVE-2000-1228 | | | 2000-12-31 | Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, con… |