CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0769
https://notcve.org/view.php?id=CVE-2007-0769
06 Feb 2007 — Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly. ** IMPUGNADA ** Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en register.php de Phorum 5.1.18 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. NOTA: el fabr... • http://www.phorum.org/phorum5/read.php?12%2C119757 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2006-6550 – Phorum 3.2.11 - 'common.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-6550
14 Dec 2006 — PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use ** IMPUGNADO ** Vulnerabilidad de inclusión remota de archivo en PHP en common.php de Phorum 3.2.11 y versiones anteriores, permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro db_file. NOTA: CVE impugan esta vulnerabili... • https://www.exploit-db.com/exploits/2894 •
CVSS: 8.1EPSS: 2%CPEs: 62EXPL: 2CVE-2006-3611 – Phorum 5 - 'pm.php' Arbitrary Local Inclusion
https://notcve.org/view.php?id=CVE-2006-3611
14 Jul 2006 — Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php. Vulnerabilidad de salto de directorio en pm.php de Phorum 5 permite a atacantes remotos autenticados incluir y ejecutar ficheros locales mediante secuencias de salto de directorio en el parámetro GLOBALS[template]... • https://www.exploit-db.com/exploits/2008 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3612
https://notcve.org/view.php?id=CVE-2006-3612
14 Jul 2006 — Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Phorum 5.1.14 permite a atacantes remotos inyectar secuencias de comando web o HTML a través de vectores no especificados. • http://www.phorum.org/phorum5/read.php?14%2C114358 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3615
https://notcve.org/view.php?id=CVE-2006-3615
14 Jul 2006 — Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable. Múltiples vulnerabilidades de inclusión remota de archivo en PHP en Phorum 5.1.14, cuando register_globals está activado, permite a atacantes remotos ejecutar código PHP de su elección a través de vectores no especificados relacionados con una variables no inicializada. • http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3249
https://notcve.org/view.php?id=CVE-2006-3249
27 Jun 2006 — SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed... • http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html •
CVSS: 9.8EPSS: 2%CPEs: 44EXPL: 2CVE-2006-3053 – PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-3053
16 Jun 2006 — PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor ** EN DISPUTA ** PHP vulnerabilidad de inclusión de archivo remoto en commo... • https://www.exploit-db.com/exploits/27363 •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 2CVE-2006-1151 – m-phorum 0.3 - 'index.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-1151
10 Mar 2006 — Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter. • https://www.exploit-db.com/exploits/30516 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-1152
https://notcve.org/view.php?id=CVE-2006-1152
10 Mar 2006 — PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. • http://secunia.com/advisories/19121 •
CVSS: 9.8EPSS: 1%CPEs: 25EXPL: 1CVE-2005-3543
https://notcve.org/view.php?id=CVE-2005-3543
16 Nov 2005 — SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter. Vulnerabilidad de inyección de SQL en Phorum 5.0.0alpha a 5.0.20, cuando "register_globals" está habilitado, permite a atacantes ejecutar órdenes SQL de su elección mediante el parámetro forum_id si register_globals está activado en PHP. • http://marc.info/?l=bugtraq&m=113122911424216&w=2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •