CVE-2011-3371 | | | 2011-10-02 | Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTM… |
CVE-2009-4894 | | | 2010-06-15 | Multiple cross-site scripting (XSS) vulnerabilities in profile.php in PunBB before 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2010-0455 | | | 2010-01-28 | Cross-site scripting (XSS) vulnerability in forum/viewtopic.php in PunBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the pid paramet… |
CVE-2008-7241 | | | 2009-09-17 | Cross-site request forgery (CSRF) vulnerability in PunBB before 1.2.17 allows remote attackers to hijack the authentication of unspecified users for requests r… |
CVE-2009-2787 | | | 2009-08-17 | Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_glob… |
CVE-2009-2786 | | | 2009-08-17 | SQL injection vulnerability in reputation.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB allows remote attackers to execute arbitrary… |
CVE-2009-2308 | | | 2009-07-02 | Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execu… |
CVE-2009-2276 | | | 2009-07-01 | SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands… |
CVE-2008-6308 | | | 2009-02-27 | Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote attackers to include and execute arbitr… |
CVE-2008-5435 | | | 2008-12-11 | Cross-site scripting (XSS) vulnerability in moderate.php in PunBB before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via a topic subje… |
CVE-2008-5434 | | | 2008-12-11 | Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) order_by… |
CVE-2008-5433 | | | 2008-12-11 | Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the password fi… |
CVE-2008-5418 | | | 2008-12-10 | Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute arbitrary local file… |
CVE-2008-3968 | | | 2008-09-11 | Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HTML via the p parame… |
CVE-2008-3336 | | | 2008-07-27 | Multiple cross-site scripting (XSS) vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject arbitrary web script or HTML via unspecified vector… |
CVE-2008-3335 | | | 2008-07-27 | Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors. |
CVE-2008-1485 | | | 2008-03-24 | Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the get_host parameter… |
CVE-2008-1484 | | | 2008-03-24 | The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to det… |
CVE-2007-2236 | | | 2007-04-25 | footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_… |
CVE-2007-2235 | | | 2007-04-25 | Multiple cross-site scripting (XSS) vulnerabilities in PunBB 1.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Refer… |
CVE-2007-2234 | | | 2007-04-25 | include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled ini_get function when checking the register_globals setting, which allows re… |
CVE-2006-5738 | High | 7.2 | 2006-11-06 | Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vecto… |
CVE-2006-5737 | | | 2006-11-06 | PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time), which might allow l… |
CVE-2006-5736 | | | 2006-11-06 | SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote attackers to execute… |
CVE-2006-5735 | | | 2006-11-06 | Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbitrary local files v… |
CVE-2006-4759 | | | 2006-09-13 | PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary fi… |
CVE-2006-2724 | | | 2006-06-01 | Cross-site scripting (XSS) vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject arbitrary HTML or web script to other administrat… |
CVE-2006-2227 | | | 2006-05-05 | Cross-site scripting (XSS) vulnerability in misc.php in PunBB 1.2.11 allows remote attackers to inject arbitrary web script or HTML via the req_message paramet… |
CVE-2006-1090 | | | 2006-03-09 | register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations. |
CVE-2006-1089 | | | 2006-03-09 | Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not… |
CVE-2006-0866 | | | 2006-02-23 | PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters. |
CVE-2006-0865 | | | 2006-02-23 | PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quickly. |
CVE-2005-4688 | | | 2005-12-31 | PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make an address change v… |
CVE-2005-4687 | | | 2005-12-31 | PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, w… |
CVE-2005-4686 | | | 2005-12-31 | PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attackers to obtain unspe… |
CVE-2005-4665 | | | 2005-12-31 | Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via Javascript contained in… |
CVE-2005-3518 | | | 2005-11-06 | SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter. |
CVE-2005-3328 | | | 2005-10-27 | PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter. |
CVE-2005-3079 | | | 2005-09-27 | PunBB before 1.2.8 allows remote attackers to perform "code inclusion" via the user language selection. |
CVE-2005-3078 | | | 2005-09-27 | Cross-site scripting (XSS) vulnerability in PunBB before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the "forgotten e-mail" featur… |
CVE-2005-2193 | | | 2005-07-11 | SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL stateme… |
CVE-2005-1051 | | | 2005-05-02 | SQL injection vulnerability in profile.php in PunBB 1.2.4 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a change_… |
CVE-2005-0818 | | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) email or (2) Jabber paramete… |
CVE-2005-0571 | | | 2005-05-02 | admin_loader.php in PunBB 1.2.1 allows remote attackers to read arbitrary files via the plugin parameter. |
CVE-2005-0570 | | | 2005-05-02 | profile.php in PunBB 1.2.1 allows remote attackers to cause a denial of service (account lockout) by setting the user's password to NULL. |
CVE-2005-0569 | | | 2005-05-02 | Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) language parameter to register.php… |
CVE-2005-1072 | | | 2005-04-08 | Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows remote attackers to inject arbitrary web script or HTML. |