CVSS: 7.5EPSS: 4%CPEs: 18EXPL: 1CVE-2004-1943 – phpBB 2.0.x - 'album_portal.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2004-1943
PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. • https://www.exploit-db.com/exploits/24026 http://marc.info/?l=bugtraq&m=108244738102532&w=2 http://www.securityfocus.com/bid/10177 https://exchange.xforce.ibmcloud.com/vulnerabilities/15916 •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2004-0339
https://notcve.org/view.php?id=CVE-2004-0339
Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter. • http://marc.info/?l=bugtraq&m=107799508130700&w=2 http://www.securityfocus.com/bid/9765 https://exchange.xforce.ibmcloud.com/vulnerabilities/15348 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 3CVE-2003-1244 – PHPBB2 - 'Page_Header.php' SQL Injection
https://notcve.org/view.php?id=CVE-2003-1244
SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possibly gain unauthorized access to forums via the forum_id parameter to index.php. • https://www.exploit-db.com/exploits/22267 http://archives.neohapsis.com/archives/bugtraq/2003-02/0245.html http://www.iss.net/security_center/static/11376.php http://www.securityfocus.com/bid/6888 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2003-1530 – phpBB 2.0.3 - 'privmsg.php' SQL Injection
https://notcve.org/view.php?id=CVE-2003-1530
SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter. • https://www.exploit-db.com/exploits/22182 http://archives.neohapsis.com/archives/bugtraq/2003-01/0125.html http://secunia.com/advisories/7887 http://www.osvdb.org/4277 http://www.securityfocus.com/archive/1/307212/30/26300/threaded http://www.securityfocus.com/bid/6634 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2003-1373
https://notcve.org/view.php?id=CVE-2003-1373
Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read and include arbitrary files via .. (dot dot) sequences followed by NULL (%00) characters in CGI parameters, as demonstrated using the lang parameter in prefs.php. • http://archives.neohapsis.com/archives/bugtraq/2003-02/0245.html http://www.securityfocus.com/bid/6889 https://exchange.xforce.ibmcloud.com/vulnerabilities/11407 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •