Phpbb
57 CVEs across 26 Phpbb products. Browse Phpbb vulnerabilities, severities, and proof-of-concept exploits.
Phpbb products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48613 | Medium | 5.9 | 2026-06-12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution… |
CVE-2026-48612 | High | 8.0 | 2026-06-12 | Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked… |
CVE-2026-48611 | Critical | 9.8 | 2026-06-12 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access… |
CVE-2026-47366 | High | 7.2 | 2026-06-12 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to… |
CVE-2026-29199 | High | 8.1 | 2026-05-04 | phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostn… |
CVE-2025-70811 | Medium | 4.3 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management… |
CVE-2025-70810 | High | 8.8 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticatio… |
CVE-2023-5917 | Low | 2.4 | 2023-11-02 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp… |
CVE-2020-8226 | Medium | 5.8 | 2020-08-17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. |
CVE-2019-16108 | High | 7.5 | 2020-03-20 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. |
CVE-2019-16107 | Medium | 4.3 | 2020-03-11 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. |
CVE-2020-5502 | Medium | 6.5 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. |
CVE-2020-5501 | Medium | 4.3 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. |
CVE-2011-0544 | Medium | 6.1 | 2019-11-14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. |
CVE-2019-16993 | High | 8.8 | 2019-09-30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An ac… |
CVE-2019-13376 | Medium | 6.5 | 2019-09-27 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking… |
CVE-2019-11767 | Medium | 5.8 | 2019-05-05 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the r… |
CVE-2019-9826 | High | 7.5 | 2019-05-02 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service. |
CVE-2018-19274 | High | 7.2 | 2018-11-17 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization w… |
CVE-2017-1000419 | High | 7.5 | 2018-01-02 | phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content an… |
CVE-2015-3880 | Medium | 6.1 | 2017-09-19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and… |
CVE-2015-1432 | | 2015-02-10 | The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers t… | |
CVE-2015-1431 | | 2015-02-10 | Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vect… | |
CVE-2010-1630 | | 2010-05-19 | Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances relate… | |
CVE-2010-1627 | | 2010-05-19 | feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions vi… | |
CVE-2009-3052 | | 2009-09-03 | SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to… | |
CVE-2008-7143 | | 2009-09-01 | phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the… | |
CVE-2008-6507 | | 2009-03-23 | Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts fo… | |
CVE-2008-6506 | | 2009-03-23 | Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors. | |
CVE-2008-6314 | | 2009-02-27 | SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via th… | |
CVE-2008-6301 | | 2009-02-26 | SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the i… | |
CVE-2008-4125 | | 2008-09-18 | The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive i… | |
CVE-2008-3224 | | 2008-07-18 | Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()." | |
CVE-2008-1766 | | 2008-04-12 | Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs." | |
CVE-2008-1565 | | 2008-03-31 | Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files v… | |
CVE-2008-1512 | | 2008-03-25 | Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and exec… | |
CVE-2008-1305 | | 2008-03-12 | SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2008-1171 | | 2008-03-05 | Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the… | |
CVE-2008-0471 | | 2008-01-29 | Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a… | |
CVE-2007-6223 | | 2007-12-04 | SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a… | |
CVE-2007-5688 | | 2007-10-29 | Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or… | |
CVE-2007-5173 | | 2007-10-03 | PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code… | |
CVE-2007-5100 | | 2007-09-26 | Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when register_globals is enabled, allow remote attackers to e… | |
CVE-2007-4984 | | 2007-09-19 | SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s… | |
CVE-2007-4653 | | 2007-09-04 | SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and earlier allows remote attackers to execute arbitrary SQL comma… | |
CVE-2007-3935 | | 2007-07-21 | PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL… | |
CVE-2007-2858 | | 2007-05-24 | SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitra… | |
CVE-2007-1961 | | 2007-04-11 | PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code… | |
CVE-2006-7174 | | 2007-03-21 | PHP remote file inclusion vulnerability in includes/functions.php in the Dimension module of phpBB allows remote attackers to execute arbitrary PHP code via a… | |
CVE-2006-7168 | | 2007-03-20 | PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL… | |
CVE-2006-7148 | | 2007-03-07 | PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PH… | |
CVE-2006-7147 | | 2007-03-07 | PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attackers to execute arbit… | |
CVE-2006-7100 | | 2007-03-03 | PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary… | |
CVE-2006-2220 | | 2007-02-08 | phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive informati… | |
CVE-2007-0761 | | 2007-02-06 | PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a UR… | |
CVE-2006-6593 | | 2006-12-15 | PHP remote file inclusion vulnerability in zufallscodepart.php in AMAZONIA MOD for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the… | |
CVE-2006-6459 | | 2006-12-11 | Cross-site scripting (XSS) vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the (1) Name… | |
CVE-2006-5418 | | 2006-10-20 | PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allows remote… | |
CVE-2006-5390 | | 2006-10-18 | PHP remote file inclusion vulnerability in includes/functions_mod_user.php in the ACP User Registration (MMW) 1.00 module for phpBB allows remote attackers to… | |
CVE-2006-5312 | | 2006-10-17 | PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arbitrary PH… | |
CVE-2006-5309 | | 2006-10-17 | PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote a… | |
CVE-2006-5306 | | 2006-10-17 | Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow remote attackers to execute arbitrary… | |
CVE-2006-5305 | | 2006-10-17 | PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attackers to execute arbitrary PHP code via… | |
CVE-2006-5301 | | 2006-10-17 | PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for phpBB allows remote attackers to execute a… | |
CVE-2006-5191 | | 2006-10-10 | PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote att… | |
CVE-2003-1530 | | 2003-12-31 | SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter. | |
CVE-2002-2349 | | 2002-12-31 | phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information. | |
CVE-2002-2346 | | 2002-12-31 | phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain… | |
CVE-2002-2287 | | 2002-12-31 | PHP remote file inclusion vulnerability in quick_reply.php for phpBB Advanced Quick Reply Hack 1.0.0 and 1.1.0 allows remote attackers to execute arbitrary PHP… | |
CVE-2002-2255 | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or H… | |
CVE-2001-1471 | High | 8.8 | 2001-07-31 | prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variable… |