CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3615
https://notcve.org/view.php?id=CVE-2006-3615
14 Jul 2006 — Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable. Múltiples vulnerabilidades de inclusión remota de archivo en PHP en Phorum 5.1.14, cuando register_globals está activado, permite a atacantes remotos ejecutar código PHP de su elección a través de vectores no especificados relacionados con una variables no inicializada. • http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3249
https://notcve.org/view.php?id=CVE-2006-3249
27 Jun 2006 — SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed... • http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html •
CVSS: 9.8EPSS: 2%CPEs: 44EXPL: 2CVE-2006-3053 – PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-3053
16 Jun 2006 — PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor ** EN DISPUTA ** PHP vulnerabilidad de inclusión de archivo remoto en commo... • https://www.exploit-db.com/exploits/27363 •
CVSS: 9.8EPSS: 1%CPEs: 25EXPL: 1CVE-2005-3543
https://notcve.org/view.php?id=CVE-2005-3543
16 Nov 2005 — SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter. Vulnerabilidad de inyección de SQL en Phorum 5.0.0alpha a 5.0.20, cuando "register_globals" está habilitado, permite a atacantes ejecutar órdenes SQL de su elección mediante el parámetro forum_id si register_globals está activado en PHP. • http://marc.info/?l=bugtraq&m=113122911424216&w=2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 1CVE-2005-2836
https://notcve.org/view.php?id=CVE-2005-2836
07 Sep 2005 — Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php. • http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html •
CVSS: 8.2EPSS: 3%CPEs: 1EXPL: 1CVE-2005-0843 – Phorum 3.x/5.0.x - HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2005-0843
24 Mar 2005 — CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header. • https://www.exploit-db.com/exploits/25258 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2005-0784
https://notcve.org/view.php?id=CVE-2005-0784
20 Mar 2005 — Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user's personal control panel. • http://marc.info/?l=bugtraq&m=111083279031544&w=2 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2005-0783 – Phorum 5.0.14 - Multiple Subject and Attachment HTML Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2005-0783
20 Mar 2005 — Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file. • https://www.exploit-db.com/exploits/25223 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2004-2242 – Phorum 5.0.7 - Search Script Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2004-2242
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter. • https://www.exploit-db.com/exploits/24331 •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 2CVE-2004-1518
https://notcve.org/view.php?id=CVE-2004-1518
31 Dec 2004 — SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter. • http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html •