CVSS: 7.5EPSS: 6%CPEs: 24EXPL: 1CVE-2005-1193 – phpBB 2.0.x - 'BBCode.php' URL Tag
https://notcve.org/view.php?id=CVE-2005-1193
The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, privmsg.php, and other scripts, allow remote attackers to execute arbitrary script via a BBcode tag with a (1) javascript:, (2) applet:, (3) about:, (4) activex:, (5) chrome:, or (6) script: URI scheme, as demonstrated using the URL tag. • https://www.exploit-db.com/exploits/25628 http://castlecops.com/t123194-.html http://marc.info/?l=full-disclosure&m=111552510000088&w=2 http://seclists.org/lists/bugtraq/2005/May/0098.html http://secunia.com/advisories/15298 http://securitytracker.com/id?1013918 http://securitytracker.com/id?1014117 http://www.kb.cert.org/vuls/id/113196 http://www.osvdb.org/16439 http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194 http://www.securityfocus.com/bid/13545&# •
CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 1CVE-2005-1290
https://notcve.org/view.php?id=CVE-2005-1290
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u parameter to profile.php, (2) highlight parameter to viewtopic.php, or (3) forumname or forumdesc parameters to admin_forums.php. • http://marc.info/?l=bugtraq&m=111428283721756&w=2 http://neosecurityteam.net/Advisories/Advisory-14.txt •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 3CVE-2005-1235
https://notcve.org/view.php?id=CVE-2005-1235
auction_my_auctions.php in phpbb-Auction 1.2m and earlier allows remote attackers to obtain sensitive information via an invalid mode parameter, which leaks the full path in a PHP error message. • http://secunia.com/advisories/15029 http://securitytracker.com/id?1013779 http://www.osvdb.org/15706 http://www.phpbb-auction.com/sutra5600.html http://www.snkenjoi.com/secadv/secadv9.txt •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 7CVE-2005-1234
https://notcve.org/view.php?id=CVE-2005-1234
Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to auction_rating.php or (2) ar parameter to action_offer.php. • http://secunia.com/advisories/15029 http://securitytracker.com/id?1013779 http://www.aria-security.net/advisory/phpauction.txt http://www.osvdb.org/15704 http://www.osvdb.org/15705 http://www.phpbb-auction.com/sutra5600.html http://www.securityfocus.com/archive/1/441190/100/0/threaded http://www.securityfocus.com/bid/13283 http://www.securityfocus.com/bid/13284 http://www.snkenjoi.com/secadv/secadv9.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/20203 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2005-1196 – phpBB 1.x/2.0.x - Knowledge Base Module 'KB.php' SQL Injection
https://notcve.org/view.php?id=CVE-2005-1196
SQL injection vulnerability in kb.php in the Knowledge Base module for phpBB allows remote attackers to obtain sensitive information and execute SQL commands via the cat parameter. • https://www.exploit-db.com/exploits/25451 http://marc.info/?l=bugtraq&m=111384185116335&w=2 •