Skip to content
Noroxi

deluxebb records

29 published records for vendor deluxebb.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
12
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

    Bar: total · dark part: CISA KEV.

    Recurring classes

    The weakness classes this vendor ships most often: where to look.

    CWE

    Attack profile

    All records

    29 records
    • CVE-2007-6237
      37Monitor

      cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, whi

      CriticalCVSS 9.0Proof of conceptEPSS 2%

      deluxebb · deluxebbDec 4, 2007

    • CVE-2006-4558
      31Monitor

      DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP cod

      HighCVSS 7.5Proof of conceptEPSS 4%

      deluxebb · deluxebbSep 5, 2006

    • CVE-2006-5154
      31Monitor

      PHP remote file inclusion vulnerability in cp/sig.php in DeluxeBB 1.09 and earlier allows remote attackers to execute arbitrary PHP code via

      HighCVSS 7.5Proof of conceptEPSS 3%

      deluxebb · deluxebbOct 5, 2006

    • CVE-2009-4465
      31Monitor

      DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user

      HighCVSS 7.5Proof of conceptEPSS 2%

      deluxebb · deluxebbDec 30, 2009

    • CVE-2006-4078
      31Monitor

      pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrar

      HighCVSS 7.5No exploitEPSS 1%

      deluxebb · deluxebbAug 10, 2006

    • CVE-2006-3304
      30Monitor

      SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn pa

      HighCVSS 7.5Proof of conceptEPSS 1%

      deluxebb · deluxebbJun 28, 2006

    • CVE-2006-3796
      30Monitor

      DeluxeBB 1.07 and earlier does not properly handle a username composed of a single space character, which allows remote authenticated users

      HighCVSS 7.5No exploitEPSS 1%

      deluxebb · deluxebbJul 24, 2006

    • CVE-2006-3799
      30Monitor

      DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other var

      HighCVSS 7.5No exploitEPSS 1%

      deluxebb · deluxebbJul 24, 2006

    • CVE-2006-3797
      30Monitor

      SQL injection vulnerability in DeluxeBB 1.07 and earlier allows remote attackers to bypass authentication, spoof users, and modify settings

      HighCVSS 7.5No exploitEPSS 1%

      deluxebb · deluxebbJul 24, 2006

    • CVE-2006-2503
      30Monitor

      SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.

      HighCVSS 7.5Proof of conceptEPSS 1%

      deluxebb · deluxebbMay 22, 2006

    • CVE-2005-2989
      30Monitor

      Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) tid pa

      HighCVSS 7.5Proof of conceptEPSS 1%

      deluxebb · deluxebbSep 19, 2005

    • CVE-2009-1033
      30Monitor

      SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder

      HighCVSS 7.5Proof of conceptEPSS 1%

      deluxebb · deluxebbMar 20, 2009

    • CVE-2008-2194
      30Monitor

      SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sort

      HighCVSS 7.5Proof of conceptEPSS 0%

      deluxebb · deluxebbMay 14, 2008

    • CVE-2008-2195
      27Monitor

      Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrar

      MediumCVSS 6.5Proof of conceptEPSS 2%

      deluxebb · deluxebbMay 14, 2008

    • CVE-2006-4079
      27Monitor

      Cross-site scripting (XSS) vulnerability in newpost.php in DeluxeBB 1.08, and possibly earlier, allows remote attackers to inject arbitrary

      MediumCVSS 6.8No exploitEPSS 1%

      deluxebb · deluxebbAug 10, 2006

    • CVE-2010-4151
      27Monitor

      SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to

      MediumCVSS 6.8Proof of conceptEPSS 1%

      deluxebb · deluxebbNov 3, 2010

    • CVE-2008-6146
      27Monitor

      SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arb

      MediumCVSS 6.8Proof of conceptEPSS 0%

      deluxebb · deluxebbFeb 16, 2009

    • CVE-2010-1859
      27Monitor

      SQL injection vulnerability in newpost.php in DeluxeBB 1.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execut

      MediumCVSS 6.8Proof of conceptEPSS 0%

      deluxebb · deluxebbMay 7, 2010

    • CVE-2006-2914
      26Monitor

      PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder p

      MediumCVSS 5.1Proof of conceptEPSS 20%

      deluxebb · deluxebbJun 23, 2006

    • CVE-2009-4466
      21Monitor

      DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installatio

      MediumCVSS 5.0Proof of conceptEPSS 2%

      deluxebb · deluxebbDec 30, 2009

    • CVE-2006-2915
      20Monitor

      Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail, (2)

      MediumCVSS 5.1No exploitEPSS 1%

      deluxebb · deluxebbJun 23, 2006

    • CVE-2006-3798
      20Monitor

      DeluxeBB 1.07 and earlier allows remote attackers to overwrite the (1) _GET, (2) _POST, (3) _ENV, and (4) _SERVER variables via the _COOKIE

      MediumCVSS 5.0No exploitEPSS 1%

      deluxebb · deluxebbJul 24, 2006

    • CVE-2011-3725
      20Monitor

      DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation pat

      MediumCVSS 5.0No exploitEPSS 1%

      deluxebb · deluxebbSep 23, 2011

    • CVE-2008-0439
      17Monitor

      Cross-site scripting (XSS) vulnerability in templates/default/admincp/attachments_header.php in DeluxeBB 1.1 allows remote attackers to inje

      MediumCVSS 4.3Proof of conceptEPSS 1%

      deluxebb · deluxebbJan 23, 2008

    • CVE-2009-4468
      17Monitor

      Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the

      MediumCVSS 4.3Proof of conceptEPSS 1%

      deluxebb · deluxebbDec 30, 2009