CVSS: 5.0EPSS: 1%CPEs: 21EXPL: 0CVE-2005-0258
https://notcve.org/view.php?id=CVE-2005-0258
Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (unlink) arbitrary files via "/../" sequences in the avatarselect parameter. • http://www.gentoo.org/security/en/glsa/glsa-200503-02.xml http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities http://www.phpbb.com/support/documents.php?mode=changelog •
CVSS: 6.4EPSS: 0%CPEs: 21EXPL: 0CVE-2005-0259
https://notcve.org/view.php?id=CVE-2005-0259
phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file. • http://secunia.com/advisories/14362 http://www.gentoo.org/security/en/glsa/glsa-200503-02.xml http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities http://www.kb.cert.org/vuls/id/774686 http://www.phpbb.com/support/documents.php?mode=changelog •
CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 3CVE-2004-2350 – phpBB 1.x/2.0.x - 'search.php?search_results' SQL Injection
https://notcve.org/view.php?id=CVE-2004-2350
SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter. • https://www.exploit-db.com/exploits/23821 http://www.securityfocus.com/archive/1/357442 http://www.securityfocus.com/bid/9883 https://exchange.xforce.ibmcloud.com/vulnerabilities/15475 •
CVSS: 7.5EPSS: 3%CPEs: 16EXPL: 1CVE-2004-1535 – phpBB 2.0.x - 'admin_cash.php' PHP Remote File Inclusion
https://notcve.org/view.php?id=CVE-2004-1535
PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code. • https://www.exploit-db.com/exploits/24751 http://marc.info/?l=bugtraq&m=110075903308817&w=2 http://marc.info/?l=bugtraq&m=110082153702843&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/18151 •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2004-1809
https://notcve.org/view.php?id=CVE-2004-1809
Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) postdays parameter to viewtopic.php or (2) topicdays parameter to viewforum.php. • http://marc.info/?l=bugtraq&m=107920498205324&w=2 http://secunia.com/advisories/11121 http://www.osvdb.org/4257 http://www.osvdb.org/4259 http://www.phpbb.com/support/documents.php?mode=changelog#206 http://www.securityfocus.com/bid/9865 http://www.securityfocus.com/bid/9866 https://exchange.xforce.ibmcloud.com/vulnerabilities/15464 •