CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 2CVE-2002-0902 – PHPBB2 - Image Tag HTML Injection
https://notcve.org/view.php?id=CVE-2002-0902
Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [IMG] tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects the script. Vulnerabilidad de secuencias de comandos en sitios cruzados en phpBB 2.0.0 (phpBB) permite a atacantes remotos ejecutar Javascript como otros usuarios de phpBB incluyendo http:// y comillas dobles ("") en una etiquieta IMG, lo que evade la comprobación de seguridad de phpBB, termina el parámetro src de la etiqueta HTML IMG, e injecta la secuencia de comandos. • https://www.exploit-db.com/exploits/21486 http://online.securityfocus.com/archive/1/274273 http://www.iss.net/security_center/static/9178.php http://www.securityfocus.com/bid/4858 •
CVSS: 10.0EPSS: 11%CPEs: 4EXPL: 0CVE-2002-0473
https://notcve.org/view.php?id=CVE-2002-0473
db.php in phpBB 2.0 (aka phpBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter. • http://archives.neohapsis.com/archives/bugtraq/2002-03/0221.html http://archives.neohapsis.com/archives/bugtraq/2002-03/0229.html http://online.securityfocus.com/archive/82/262600 http://phpbb.sourceforge.net/phpBB2/viewtopic.php?t=9483 http://prdownloads.sourceforge.net/phpbb/phpBB-2.0.1.zip http://www.iss.net/security_center/static/8476.php http://www.osvdb.org/4268 http://www.securityfocus.com/bid/4380 •
CVSS: 5.0EPSS: 1%CPEs: 7EXPL: 0CVE-2002-0533
https://notcve.org/view.php?id=CVE-2002-0533
phpBB 1.4.4 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via null \0 characters within [code] tags. • http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0005.html http://marc.info/?l=bugtraq&m=101794993119738&w=2 http://online.securityfocus.com/archive/1/265798 http://www.iss.net/security_center/static/8764.php http://www.securityfocus.com/bid/4432 http://www.securityfocus.com/bid/4434 •
CVSS: 5.1EPSS: 0%CPEs: 7EXPL: 0CVE-2002-0475
https://notcve.org/view.php?id=CVE-2002-0475
Cross-site scripting vulnerability in phpBB 1.4.4 and earlier allows remote attackers to execute arbitrary Javascript on web clients by embedding the script within an IMG image tag while editing a message. • http://www.iss.net/security_center/static/7459.php http://www.securiteam.com/unixfocus/6W00Q202UM.html http://www.securityfocus.com/bid/4379 •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 2CVE-2001-1471 – phpBB 1.x - Page Header Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2001-1471
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement. • https://www.exploit-db.com/exploits/21065 http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.html http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.html http://www.kb.cert.org/vuls/id/920931 http://www.securityfocus.com/bid/3167 https://exchange.xforce.ibmcloud.com/vulnerabilities/6944 • CWE-665: Improper Initialization •