CVSS: 7.5EPSS: 6%CPEs: 30EXPL: 4CVE-2006-2865 – phpBB 2.0.x - 'template.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-2865
PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page variable. It is possible that this is a site-specific vulnerability, or an issue in a mod • https://www.exploit-db.com/exploits/27961 http://www.securityfocus.com/archive/1/435869/100/0/threaded http://www.securityfocus.com/archive/1/435978/100/0/threaded http://www.securityfocus.com/archive/1/435995/100/0/threaded http://www.securityfocus.com/archive/1/436118/100/0/threaded http://www.securityfocus.com/bid/18255 •
CVSS: 5.1EPSS: 6%CPEs: 16EXPL: 2CVE-2006-2134 – Knowledge Base Mod 2.0.2 - 'phpBB' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-2134
PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. • https://www.exploit-db.com/exploits/1728 http://secunia.com/advisories/19892 http://www.securityfocus.com/bid/17763 http://www.vupen.com/english/advisories/2006/1585 https://exchange.xforce.ibmcloud.com/vulnerabilities/26279 •
CVSS: 6.4EPSS: 1%CPEs: 29EXPL: 1CVE-2006-0632
https://notcve.org/view.php?id=CVE-2006-0632
The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts. • http://secunia.com/advisories/18727 http://www.osvdb.org/22949 http://www.r-security.net/tutorials/view/readtutorial.php?id=4 http://www.securityfocus.com/archive/1/424074/100/0/threaded http://www.vupen.com/english/advisories/2006/0461 https://exchange.xforce.ibmcloud.com/vulnerabilities/24573 •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 1CVE-2006-0437
https://notcve.org/view.php?id=CVE-2006-0437
Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html http://secunia.com/advisories/18693 http://securityreason.com/achievement_securityalert/31 http://securityreason.com/securityalert/406 http://www.osvdb.org/22928 http://www.vupen.com/english/advisories/2006/0445 https://exchange.xforce.ibmcloud.com/vulnerabilities/24497 •
CVSS: 5.0EPSS: 4%CPEs: 29EXPL: 1CVE-2006-0438
https://notcve.org/view.php?id=CVE-2006-0438
Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html http://secunia.com/advisories/18693 http://securityreason.com/achievement_securityalert/31 http://securityreason.com/securityalert/406 http://www.osvdb.org/22929 http://www.vupen.com/english/advisories/2006/0445 https://exchange.xforce.ibmcloud.com/vulnerabilities/24497 •