CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2013-2057
https://notcve.org/view.php?id=CVE-2013-2057
11 Feb 2020 — YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability YaBB versiones hasta 2.5.2: Vulnerabilidad de Inclusión de Archivo Local del Parámetro de Cookie "guestlanguage". • http://www.openwall.com/lists/oss-security/2013/05/05/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 2CVE-2006-4157 – YaBBSE 1.x - 'index.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-4157
16 Aug 2006 — Cross-site scripting (XSS) vulnerability in index.php in Yet another Bulletin Board (YaBB) allows remote attackers to inject arbitrary web script or HTML via the categories parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php en Yet another Bulletin Board (YaBB) permite a atacantes remotos iynectar secuencias de comandos web o HTML de su elección a través del parámetro categories. • https://www.exploit-db.com/exploits/28371 •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2006-3275
https://notcve.org/view.php?id=CVE-2006-3275
28 Jun 2006 — SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action. Vulnerabilidad de inyección SQL en profile.php en YaBB SE v1.5.5 y anteriores permite a atacantes remotos ejecutar comandos SQL a través de parámetros de usuario double-encoded en una acción viewprofile. • http://marc.info/?l=full-disclosure&m=115102378824221&w=2 •
CVSS: 9.8EPSS: 1%CPEs: 9EXPL: 2CVE-2004-2754 – YABB SE 1.x - 'SSI.php' ID_MEMBER SQL Injection
https://notcve.org/view.php?id=CVE-2004-2754
31 Dec 2004 — SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions. • https://www.exploit-db.com/exploits/23554 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2004-1662
https://notcve.org/view.php?id=CVE-2004-1662
25 Aug 2004 — YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message. • http://echo.or.id/adv/adv05-y3dips-2004.txt •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2004-1827 – YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-1827
15 Mar 2004 — Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags. • https://www.exploit-db.com/exploits/23812 •
CVSS: 7.5EPSS: 6%CPEs: 4EXPL: 3CVE-2002-0117 – YaBB 9.1.2000 - Cross-Agent Scripting
https://notcve.org/view.php?id=CVE-2002-0117
25 Mar 2002 — Cross-site scripting vulnerability in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 and earlier allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag. Vulnerabilidad Cross-site todavía en el Bulletin Board de (YaBB) 1 Gold SP 1 y anteriores permite a atacantes remotos ejecutar scripts arbitrarios y cookiess de robo vía un mensaje que contiene Javascript codificado en una etiqueta IMG. • https://www.exploit-db.com/exploits/21208 •