CVSS: 7.5EPSS: 1%CPEs: 19EXPL: 2CVE-2003-1216 – phpBB 2.0.6 - 'search_id' SQL Injection / MD5 Hash
https://notcve.org/view.php?id=CVE-2003-1216
SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter. • https://www.exploit-db.com/exploits/137 http://marc.info/?l=bugtraq&m=106997132425576&w=2 http://marc.info/?l=bugtraq&m=107005608726609&w=2 http://marc.info/?l=bugtraq&m=107196735102970&w=2 http://www.phpbb.com/phpBB/viewtopic.php?t=153818 http://www.securityfocus.com/bid/9122 https://exchange.xforce.ibmcloud.com/vulnerabilities/13867 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2003-0486 – phpBB 2.0.5 - SQL Injection Password Disclosure
https://notcve.org/view.php?id=CVE-2003-0486
SQL injection vulnerability in viewtopic.php for phpBB 2.0.5 and earlier allows remote attackers to steal password hashes via the topic_id parameter. Vulnerabilidad de inyección de SQL en viewtopic.php de phpBB 2.0.5 y anteriores permite a atacantes remotos robar picadillos (hashes) de contraseñas mediante el parámetro topic_id. • https://www.exploit-db.com/exploits/44 http://marc.info/?l=bugtraq&m=105607263130644&w=2 http://www.phpbb.com/phpBB/viewtopic.php?t=112052 http://www.securityfocus.com/bid/7979 https://exchange.xforce.ibmcloud.com/vulnerabilities/12366 •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2002-1707
https://notcve.org/view.php?id=CVE-2002-1707
install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code. • http://online.securityfocus.com/archive/1/277318 http://www.securityfocus.com/bid/5038 https://exchange.xforce.ibmcloud.com/vulnerabilities/9370 •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2002-2346
https://notcve.org/view.php?id=CVE-2002-2346
phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses. • http://online.securityfocus.com/archive/1/294560 http://www.iss.net/security_center/static/10323.php http://www.securityfocus.com/bid/5923 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 2CVE-2002-0902 – PHPBB2 - Image Tag HTML Injection
https://notcve.org/view.php?id=CVE-2002-0902
Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [IMG] tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects the script. Vulnerabilidad de secuencias de comandos en sitios cruzados en phpBB 2.0.0 (phpBB) permite a atacantes remotos ejecutar Javascript como otros usuarios de phpBB incluyendo http:// y comillas dobles ("") en una etiquieta IMG, lo que evade la comprobación de seguridad de phpBB, termina el parámetro src de la etiqueta HTML IMG, e injecta la secuencia de comandos. • https://www.exploit-db.com/exploits/21486 http://online.securityfocus.com/archive/1/274273 http://www.iss.net/security_center/static/9178.php http://www.securityfocus.com/bid/4858 •