CVSS: 6.0EPSS: 3%CPEs: 32EXPL: 1CVE-2006-6421 – phpBB 2.0.21 - 'privmsg.php' HTML Injection
https://notcve.org/view.php?id=CVE-2006-6421
Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el buzón de mensajes privados en phpBB 2.0.x permite a un usuario remoto validado inyectar secuencias de comandos web o HTML a través del campo "cuerpo de mensaje" de un mensaje a un usuario no existente. • https://www.exploit-db.com/exploits/29442 http://secunia.com/advisories/23283 http://securityreason.com/securityalert/2005 http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624 http://www.securityfocus.com/archive/1/453774/100/0/threaded http://www.securityfocus.com/archive/1/456579/100/0/threaded http://www.securityfocus.com/archive/1/456728/100/100/threaded http://www.securityfocus.com/archive/1/456784/100/100/threaded http://www.securityfocus.com/bid/21806 http:/ •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-5435
https://notcve.org/view.php?id=CVE-2006-5435
PHP remote file inclusion vulnerability in groupcp.php in phpBB 2.0.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: CVE and the vendor dispute this vulnerability because $phpbb_root_path is defined before use ** IMPUGNADA ** Vulnerabilidad PHP de inclusión remota de archivo en groupcp.php en phpBB 2.0.10 y anteriores permite a un atacante remoto ejecutar código PHP de su elección a través de una URL en el parámeto phpbb_root_path. NOTA: el CVE y el fabricante niegan esta vulnerabilidad porque $phpbb_root_path se define antes de usarlo. • http://www.securityfocus.com/archive/1/449114/100/0/threaded http://www.securityfocus.com/archive/1/449232/100/0/threaded •
CVSS: 7.5EPSS: 6%CPEs: 31EXPL: 1CVE-2006-5209 – phpBB Admin Topic Action Logging Mod 0.94b - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-5209
PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Admin Topic Action Logging Mod 0.95 and earlier, as used in phpBB 2.0 up to 2.0.21, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Vulnerabilidad de inclusión remota de archivo en PHP en admin/admin_tocpi_action_logging.php en Admin Topic Action Logging Mod 0.95 y anteriores, usado en phpBB 2.0 hasta 2.0.21, permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro phpbb_root_path. • https://www.exploit-db.com/exploits/2475 https://exchange.xforce.ibmcloud.com/vulnerabilities/29345 •
CVSS: 5.1EPSS: 12%CPEs: 1EXPL: 2CVE-2006-5094 – phpBB XS 0.58a - 'phpbb_root_path' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-5094
PHP remote file inclusion vulnerability in includes/functions_kb.php in the phpBB XS 2 (Spain version) allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780 or CVE-2006-4893. Vulnerabilidad PHP de inclusión remota de archivo en includes/functions_kb.php en el phpBB XS 2 (version española) permite a un atacante remoto ejecutar código PHP de su elección a través de una URL en el parámetro phpbb_root_path, un vector diferente que CVE-2006-4780 o CVE-2006-4893. • https://www.exploit-db.com/exploits/2453 http://secunia.com/advisories/22177 http://securityreason.com/securityalert/1660 http://www.nyubicrew.org/adv/solpot-adv-10.txt http://www.securityfocus.com/archive/1/447292/100/0/threaded http://www.securityfocus.com/bid/20251 http://www.vupen.com/english/advisories/2006/3843 https://exchange.xforce.ibmcloud.com/vulnerabilities/29250 •
CVSS: 7.5EPSS: 6%CPEs: 30EXPL: 4CVE-2006-2865 – phpBB 2.0.x - 'template.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-2865
PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page variable. It is possible that this is a site-specific vulnerability, or an issue in a mod • https://www.exploit-db.com/exploits/27961 http://www.securityfocus.com/archive/1/435869/100/0/threaded http://www.securityfocus.com/archive/1/435978/100/0/threaded http://www.securityfocus.com/archive/1/435995/100/0/threaded http://www.securityfocus.com/archive/1/436118/100/0/threaded http://www.securityfocus.com/bid/18255 •