CVSS: 9.8EPSS: 89%CPEs: 29EXPL: 4CVE-2004-1315 – PHP-Nuke 7.0/8.1/8.1.35 - Wormable Remote Code Execution
https://notcve.org/view.php?id=CVE-2004-1315
12 Nov 2004 — viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm. • https://www.exploit-db.com/exploits/12510 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2004-0729
https://notcve.org/view.php?id=CVE-2004-0729
23 Jul 2004 — PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid (1) category_rows parameter to index.php, (2) faq parameter to faq.php, or (3) ranksrow parameter to profile.php, which reveal the full path in an error message. phpBB 2.0.8 permiteaatacantes remotos obtener información sensible mediante parámetros inválidos: (1) category_rows a index.php, (2) faq a faq.php, o (3) ranksrow a profile.php, lo que revela la ruta completa en el mensaje de error. • http://marc.info/?l=bugtraq&m=108999024506020&w=2 •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2004-0730
https://notcve.org/view.php?id=CVE-2004-0730
23 Jul 2004 — Multiple cross-site scripting (XSS) vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via (1) the cat_title parameter in index.php, (2) the faq[0][0] parameter in lang_faq.php as accessible from faq.php, or (3) the faq[0][0] parameter in lang_bbcode.php as accessible from faq.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpBB 2.0.8 permite a atacantes remotos inyectar scritp web o HTML de su elección mediante (1) el parámetr... • http://marc.info/?l=bugtraq&m=108999024506020&w=2 •
CVSS: 6.1EPSS: 0%CPEs: 19EXPL: 1CVE-2004-2055
https://notcve.org/view.php?id=CVE-2004-2055
19 Jul 2004 — Cross-site scripting (XSS) vulnerability in search.php for PhpBB 2.0.4 and 2.0.9 allows remote attackers to inject arbitrary HTMl or web script via the search_author parameter. • http://marc.info/?l=bugtraq&m=109034476122723&w=2 •
CVSS: 9.8EPSS: 1%CPEs: 18EXPL: 1CVE-2004-1943 – phpBB 2.0.x - 'album_portal.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2004-1943
19 Apr 2004 — PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. • https://www.exploit-db.com/exploits/24026 •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 1CVE-2004-1950
https://notcve.org/view.php?id=CVE-2004-1950
19 Apr 2004 — phpBB 2.0.8a and earlier trusts the IP address that is in the X-Forwarded-For in the HTTP header, which allows remote attackers to spoof IP addresses. • http://marc.info/?l=bugtraq&m=108239864203144&w=2 •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2004-0339
https://notcve.org/view.php?id=CVE-2004-0339
18 Mar 2004 — Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter. • http://marc.info/?l=bugtraq&m=107799508130700&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 3CVE-2003-1244 – PHPBB2 - 'Page_Header.php' SQL Injection
https://notcve.org/view.php?id=CVE-2003-1244
31 Dec 2003 — SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possibly gain unauthorized access to forums via the forum_id parameter to index.php. • https://www.exploit-db.com/exploits/22267 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2003-1373
https://notcve.org/view.php?id=CVE-2003-1373
31 Dec 2003 — Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read and include arbitrary files via .. (dot dot) sequences followed by NULL (%00) characters in CGI parameters, as demonstrated using the lang parameter in prefs.php. • http://archives.neohapsis.com/archives/bugtraq/2003-02/0245.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2003-1530 – phpBB 2.0.3 - 'privmsg.php' SQL Injection
https://notcve.org/view.php?id=CVE-2003-1530
31 Dec 2003 — SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter. • https://www.exploit-db.com/exploits/22182 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •