Skip to content
Noroxi

Phorum records

57 published records for vendor phorum.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
13
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

57 records
  • CVE-2003-1487
    42Plan

    Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the

    CriticalCVSS 10.0No exploitEPSS 8%

    phorum · phorumDec 31, 2003

  • CVE-2002-0764
    41Plan

    Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php tha

    HighCVSS 7.5Proof of conceptEPSS 38%

    phorum · phorumAug 12, 2002

  • CVE-2007-2338
    33Monitor

    Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unau

    HighCVSS 7.5Proof of conceptEPSS 9%

    phorum · phorumApr 27, 2007

  • CVE-2006-3053
    31Monitor

    PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via

    HighCVSS 7.5Proof of conceptEPSS 3%

    phorum · phorumJun 16, 2006

  • CVE-2006-6550
    31Monitor

    PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via

    HighCVSS 7.5Proof of conceptEPSS 2%

    phorum · phorumDec 14, 2006

  • CVE-2000-1233
    31Monitor

    SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the

    HighCVSS 7.5No exploitEPSS 2%

    phorum · phorumDec 31, 2000

  • CVE-2007-2339
    31Monitor

    Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified r

    HighCVSS 7.5Proof of conceptEPSS 2%

    phorum · phorumApr 27, 2007

  • CVE-2004-2240
    30Monitor

    Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string

    HighCVSS 7.5No exploitEPSS 2%

    phorum · phorumDec 31, 2004

  • CVE-2004-2243
    30Monitor

    Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter,

    HighCVSS 7.5No exploitEPSS 2%

    phorum · phorumDec 31, 2004

  • CVE-2003-1466
    30Monitor

    Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) reg

    HighCVSS 7.5No exploitEPSS 1%

    phorum · phorumDec 31, 2003

  • CVE-2004-0035
    30Monitor

    SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the h

    HighCVSS 7.5No exploitEPSS 1%

    phorum · phorumJan 20, 2004

  • CVE-2004-1938
    30Monitor

    SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encode

    HighCVSS 7.5Proof of conceptEPSS 1%

    phorum · phorumApr 19, 2004

  • CVE-2006-3249
    30Monitor

    SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the pag

    HighCVSS 7.5No exploitEPSS 1%

    phorum · phorumJun 27, 2006

  • CVE-2004-2110
    30Monitor

    SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_em

    HighCVSS 7.5No exploitEPSS 1%

    phorum · phorumDec 31, 2004

  • CVE-2007-2249
    28Monitor

    include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_id

    MediumCVSS 6.5Proof of conceptEPSS 7%

    phorum · phorumApr 25, 2007

  • CVE-2003-0283
    28Monitor

    Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a m

    MediumCVSS 6.8Proof of conceptEPSS 4%

    phorum · phorumJun 16, 2003

  • CVE-2005-3543
    27Monitor

    SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to

    MediumCVSS 6.8No exploitEPSS 1%

    phorum · phorumNov 16, 2005

  • CVE-2007-0769
    27Monitor

    Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via

    MediumCVSS 6.8No exploitEPSS 1%

    phorum · phorumFeb 5, 2007

  • CVE-2007-0767
    27Monitor

    Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML

    MediumCVSS 6.8No exploitEPSS 1%

    phorum · phorumFeb 5, 2007

  • CVE-2008-1486
    27Monitor

    SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands

    MediumCVSS 6.8No exploitEPSS 1%

    phorum · phorumMar 24, 2008

  • CVE-2011-3381
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified

    MediumCVSS 6.8No exploitEPSS 1%

    phorum · phorumSep 8, 2011

  • CVE-2011-3622
    24Monitor

    A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.

    MediumCVSS 6.1No exploitEPSS 1%

    phorum · phorumJan 22, 2020

  • CVE-2006-3611
    23Monitor

    Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via d

    MediumCVSS 5.5Proof of conceptEPSS 2%

    phorum · phorumJul 18, 2006

  • CVE-2006-6968
    23Monitor

    Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to

    MediumCVSS 5.8No exploitEPSS 1%

    phorum · phorumFeb 5, 2007

  • CVE-2005-0843
    21Monitor

    CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body

    MediumCVSS 5.0Proof of conceptEPSS 4%

    phorum · phorumMay 2, 2005