Phpbb Phpbb
47 CVEs affecting Phpbb Phpbb. Latest disclosed: 2026-06-12. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48611 | Critical | 9.8 | 2026-06-12 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access… |
CVE-2025-70810 | High | 8.8 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticatio… |
CVE-2019-16993 | High | 8.8 | 2019-09-30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An ac… |
CVE-2001-1471 | High | 8.8 | 2001-07-31 | prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variable… |
CVE-2026-29199 | High | 8.1 | 2026-05-04 | phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostn… |
CVE-2026-48612 | High | 8.0 | 2026-06-12 | Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked… |
CVE-2019-16108 | High | 7.5 | 2020-03-20 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. |
CVE-2019-9826 | High | 7.5 | 2019-05-02 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service. |
CVE-2017-1000419 | High | 7.5 | 2018-01-02 | phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content an… |
CVE-2026-47366 | High | 7.2 | 2026-06-12 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to… |
CVE-2018-19274 | High | 7.2 | 2018-11-17 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization w… |
CVE-2020-5502 | Medium | 6.5 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. |
CVE-2019-13376 | Medium | 6.5 | 2019-09-27 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking… |
CVE-2011-0544 | Medium | 6.1 | 2019-11-14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. |
CVE-2015-3880 | Medium | 6.1 | 2017-09-19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and… |
CVE-2026-48613 | Medium | 5.9 | 2026-06-12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution… |
CVE-2020-8226 | Medium | 5.8 | 2020-08-17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. |
CVE-2019-11767 | Medium | 5.8 | 2019-05-05 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the r… |
CVE-2025-70811 | Medium | 4.3 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management… |
CVE-2019-16107 | Medium | 4.3 | 2020-03-11 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. |