Phpbb Group vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-87901 Improper sanitization in the registration module allows reflected Cross-Site Scripting.High 8.3 · Oct 23, 2026
• CVE-2026-48612 Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked High 8 · Jun 12, 2026
• CVE-2026-48611 Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access iCritical 9.8 · Jun 12, 2026
• CVE-2026-47366 Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to High 7.2 · Jun 12, 2026
• CVE-2026-29199 phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning.High 8.1 · May 4, 2026
• CVE-2025-70810 Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticationHigh 8.8 · Apr 9, 2026
• CVE-2019-16108 phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.High 7.5 · Mar 19, 2020
• CVE-2019-16993 In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel.High 8.8 · Sep 30, 2019
• CVE-2019-9826 The fulltext search component in phpBB before 3.2.6 allows Denial of Service.High 7.5 · May 2, 2019
• CVE-2018-19274 Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization whHigh 7.2 · Nov 17, 2018
• CVE-2017-1000419 phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content andHigh 7.5 · Jan 2, 2018
• CVE-2010-1630 Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances relatedHigh 7.5 · May 19, 2010
• CVE-2008-6314 SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via theHigh 7.5 · Feb 27, 2009
• CVE-2008-3224 Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within login_box()."High 10 · Jul 18, 2008
• CVE-2008-1766 Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."High 10 · Apr 12, 2008
• CVE-2008-1512 Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execuHigh 7.5 · Mar 25, 2008
• CVE-2007-6223 SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a sHigh 7.5 · Dec 4, 2007
• CVE-2007-4653 SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and earlier allows remote attackers to execute arbitrary SQL commanHigh 7.5 · Sep 4, 2007
• CVE-2007-3935 PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL iHigh 9.3 · Jul 20, 2007
• CVE-2007-1961 PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code vHigh 7.5 · Apr 11, 2007
• CVE-2007-1695 PHP remote file inclusion vulnerability in includes/usercp_register.php in phpBB 2.0.19 allows remote attackers to execute arbitrary PHP code via a URL in the pHigh 10 · Mar 26, 2007
• CVE-2006-7174 PHP remote file inclusion vulnerability in includes/functions.php in the Dimension module of phpBB allows remote attackers to execute arbitrary PHP code via a UHigh 10 · Mar 21, 2007
• CVE-2006-7168 PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL iHigh 7.5 · Mar 20, 2007
• CVE-2006-7148 PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHPHigh 10 · Mar 7, 2007
• CVE-2007-0761 PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a URLHigh 7.5 · Feb 5, 2007