CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2008-4513
https://notcve.org/view.php?id=CVE-2008-4513
Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo BBcode API en Phorum v5.2.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante una etiqueta "image" (imagen) en BBcode. • http://nulledcore.com/?p=126 http://secunia.com/advisories/32225 http://trac.phorum.org/changeset/3528 http://www.phorum.org/phorum5/read.php?64%2C133699 http://www.securityfocus.com/bid/31589 https://exchange.xforce.ibmcloud.com/vulnerabilities/45686 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 40EXPL: 0CVE-2008-1486
https://notcve.org/view.php?id=CVE-2008-1486
SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search. Una vulnerabilidad de inyección SQL en Phorum versiones anteriores a 5.2.6, cuando la función mysql_use_ft está deshabilitado, permite a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de la búsqueda sin texto completo. • http://secunia.com/advisories/29519 http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815 http://www.securityfocus.com/bid/28540 https://exchange.xforce.ibmcloud.com/vulnerabilities/41418 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 7%CPEs: 1EXPL: 4CVE-2007-2338 – Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion
https://notcve.org/view.php?id=CVE-2007-2338
Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en include/admin/banlist.php en Phorum anterior a 5.1.22 permite a atacantes remotos realizar borrados de la banlist no autorizados como administrador a través del parámetro delete. • https://www.exploit-db.com/exploits/29891 http://osvdb.org/35061 http://secunia.com/advisories/24932 http://securityreason.com/securityalert/2617 http://securitytracker.com/id?1017936 http://www.phorum.org/story.php?76 http://www.securityfocus.com/archive/1/466286/100/0/threaded http://www.securityfocus.com/bid/23616 http://www.vupen.com/english/advisories/2007/1479 http://www.waraxe.us/advisory-49.html https://exchange.xforce.ibmcloud.com/vulnerabilities/34078 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 6CVE-2007-2339 – Phorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection
https://notcve.org/view.php?id=CVE-2007-2339
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php. Múltiples vulnerabilidades de inyección SQL en Phorum anterior a 5.1.22 permite a atacantes remotos ejecutar comandos SQL de su elección a través de (1)un nombre modificado del parámetro de los recipientes en (a) pm.php; (2) el parámetro curr en (b)badwords (también conocido como censorlist) o (c) móldulo banlist en admin.php; o (3) el campo "editar grupos / Añadir grupo" en el módulo (d) groups en admin.php. • https://www.exploit-db.com/exploits/29893 https://www.exploit-db.com/exploits/29894 https://www.exploit-db.com/exploits/29892 http://osvdb.org/35062 http://osvdb.org/35063 http://osvdb.org/35064 http://secunia.com/advisories/24932 http://securityreason.com/securityalert/2617 http://securitytracker.com/id?1017936 http://www.phorum.org/story.php?76 http://www.securityfocus.com/archive/1/466286/100/0/threaded http://www.securityfocus.com/bid/23616 http://www •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 3CVE-2007-2250 – Phorum 5.1.20 - 'admin.php?module[]' Full Path Disclosure
https://notcve.org/view.php?id=CVE-2007-2250
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter. admin.php de Phorum versiones anteriores a 5.1.22 permite a atacantes remotos obtener la ruta completa mediante el parámetro module[]. • https://www.exploit-db.com/exploits/29890 http://osvdb.org/35060 http://secunia.com/advisories/24932 http://securityreason.com/securityalert/2617 http://www.phorum.org/story.php?76 http://www.securityfocus.com/archive/1/466286/100/0/threaded http://www.securityfocus.com/bid/23616 http://www.securitytracker.com/id?1017936 http://www.vupen.com/english/advisories/2007/1479 http://www.waraxe.us/advisory-49.html •