Skip to content
Noroxi

punbb records

47 published records for vendor punbb.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
13
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

    Bar: total · dark part: CISA KEV.

    Recurring classes

    The weakness classes this vendor ships most often: where to look.

    CWE

    Attack profile

    All records

    47 records
    • CVE-2008-3335
      41Plan

      Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors.

      CriticalCVSS 10.0No exploitEPSS 3%

      punbb · punbbJul 27, 2008

    • CVE-2006-5735
      34Monitor

      Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbi

      HighCVSS 7.5No exploitEPSS 14%

      punbb · punbbNov 6, 2006

    • CVE-2006-1090
      32Monitor

      register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.

      HighCVSS 7.8Proof of conceptEPSS 4%

      punbb · punbbMar 9, 2006

    • CVE-2005-3518
      31Monitor

      SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_sea

      HighCVSS 7.5Proof of conceptEPSS 3%

      punbb · punbbNov 6, 2005

    • CVE-2005-0569
      31Monitor

      Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) language paramete

      HighCVSS 7.5Proof of conceptEPSS 3%

      punbb · punbbMay 2, 2005

    • CVE-2005-3328
      31Monitor

      PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the

      HighCVSS 7.5No exploitEPSS 3%

      punbb · punbbOct 27, 2005

    • CVE-2005-2193
      30Monitor

      SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute ar

      HighCVSS 7.5No exploitEPSS 1%

      punbb · punbbJul 11, 2005

    • CVE-2009-2308
      30Monitor

      Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote

      HighCVSS 7.5Proof of conceptEPSS 1%

      punbb · punbbJul 2, 2009

    • CVE-2007-2234
      30Monitor

      include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled ini_get function when checking the register_globals setti

      HighCVSS 7.5No exploitEPSS 1%

      punbb · punbbApr 25, 2007

    • CVE-2009-2786
      30Monitor

      SQL injection vulnerability in reputation.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB allows remote attackers to

      HighCVSS 7.5Proof of conceptEPSS 1%

      punbb · punbbAug 17, 2009

    • CVE-2009-2276
      30Monitor

      SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arb

      HighCVSS 7.5Proof of conceptEPSS 1%

      punbb · punbbJul 1, 2009

    • CVE-2009-2787
      28Monitor

      Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB,

      MediumCVSS 6.8Proof of conceptEPSS 4%

      punbb · punbbAug 17, 2009

    • CVE-2006-5738
      28Monitor

      Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands vi

      HighCVSS 7.2No exploitEPSS 1%

      punbb · punbbNov 6, 2006

    • CVE-2006-5737
      28Monitor

      PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time),

      HighCVSS 7.2No exploitEPSS 0%

      punbb · punbbNov 6, 2006

    • CVE-2005-1051
      27Monitor

      SQL injection vulnerability in profile.php in PunBB 1.2.4 allows remote authenticated users to execute arbitrary SQL commands via the id par

      MediumCVSS 6.5Proof of conceptEPSS 2%

      punbb · punbbMay 2, 2005

    • CVE-2007-2236
      27Monitor

      footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) atta

      MediumCVSS 6.8No exploitEPSS 1%

      punbb · punbbApr 25, 2007

    • CVE-2006-2724
      27Monitor

      Cross-site scripting (XSS) vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject arbitrary HTML or web script t

      MediumCVSS 6.8No exploitEPSS 1%

      punbb · punbbMay 31, 2006

    • CVE-2008-7241
      27Monitor

      Cross-site request forgery (CSRF) vulnerability in PunBB before 1.2.17 allows remote attackers to hijack the authentication of unspecified u

      MediumCVSS 6.8No exploitEPSS 1%

      punbb · punbbSep 17, 2009

    • CVE-2008-5434
      26Monitor

      Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands vi

      MediumCVSS 6.5No exploitEPSS 1%

      punbb · punbbDec 11, 2008

    • CVE-2006-0865
      21Monitor

      PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quick

      MediumCVSS 5.0Proof of conceptEPSS 3%

      punbb · punbbFeb 23, 2006

    • CVE-2008-6308
      21Monitor

      Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote attackers to include

      MediumCVSS 5.1Proof of conceptEPSS 2%

      punbb · private messaging systemFeb 26, 2009

    • CVE-2008-5418
      21Monitor

      Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute a

      MediumCVSS 5.1Proof of conceptEPSS 2%

      punbb · punbbDec 10, 2008

    • CVE-2005-0570
      20Monitor

      profile.php in PunBB 1.2.1 allows remote attackers to cause a denial of service (account lockout) by setting the user's password to NULL.

      MediumCVSS 5.0No exploitEPSS 2%

      punbb · punbbMay 2, 2005

    • CVE-2005-0571
      20Monitor

      admin_loader.php in PunBB 1.2.1 allows remote attackers to read arbitrary files via the plugin parameter.

      MediumCVSS 5.0No exploitEPSS 1%

      punbb · punbbMay 2, 2005

    • CVE-2005-4687
      20Monitor

      PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than

      MediumCVSS 5.0No exploitEPSS 1%

      punbb · punbbDec 31, 2005