Skip to content
Noroxi

SimpleMachines records

31 published records for vendor simplemachines.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
6
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 24
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

31 records
  • CVE-2011-1127
    41Plan

    SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote a

    CriticalCVSS 10.0No exploitEPSS 2%

    simplemachines · smfJun 20, 2011

  • CVE-2005-4891
    40Plan

    Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary S

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    simplemachines · simple machine forumJan 15, 2020

  • CVE-2016-5726
    39Monitor

    Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co

    CriticalCVSS 9.8No exploitEPSS 1%

    simplemachines · simple machines forumFeb 9, 2017

  • CVE-2019-11574
    39Monitor

    An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17.

    CriticalCVSS 9.8No exploitEPSS 1%

    simplemachines · simple machine forumMar 20, 2020

  • CVE-2018-10305
    39Monitor

    The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users var

    CriticalCVSS 9.8No exploitEPSS 1%

    simplemachines · simple machines forumApr 23, 2018

  • CVE-2013-7466
    36Monitor

    Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traver

    HighCVSS 8.8No exploitEPSS 4%

    simplemachines · simple machines forumMar 7, 2019

  • CVE-2016-5727
    35Monitor

    LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co

    HighCVSS 8.8No exploitEPSS 1%

    simplemachines · simple machines forumFeb 9, 2017

  • CVE-2013-7468
    33Monitor

    Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter.

    HighCVSS 8.1No exploitEPSS 1%

    simplemachines · simple machines forumMar 7, 2019

  • CVE-2008-6971
    32Monitor

    The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes

    HighCVSS 7.5Proof of conceptEPSS 7%

    simplemachines · smfAug 13, 2009

  • CVE-2022-26982
    31Monitor

    SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php cod

    HighCVSS 7.2Proof of conceptEPSS 9%

    simplemachines · simple machines forumApr 5, 2022

  • CVE-2011-1128
    30Monitor

    The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle inv

    HighCVSS 7.5No exploitEPSS 1%

    simplemachines · smfJun 20, 2011

  • CVE-2013-7235
    30Monitor

    Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space cha

    HighCVSS 7.5No exploitEPSS 1%

    simplemachines · simple machines forumApr 29, 2014

  • CVE-2013-7236
    30Monitor

    Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph charac

    HighCVSS 7.5No exploitEPSS 1%

    simplemachines · simple machines forumApr 29, 2014

  • CVE-2011-3615
    30Monitor

    Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute a

    HighCVSS 7.5No exploitEPSS 1%

    simplemachines · smfOct 24, 2011

  • CVE-2011-1130
    30Monitor

    Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote

    HighCVSS 7.5No exploitEPSS 1%

    simplemachines · smfJun 20, 2011

  • CVE-2009-5068
    29Monitor

    There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3.

    HighCVSS 7.2Proof of conceptEPSS 1%

    simplemachines · simple machines forumJan 15, 2020

  • CVE-2011-4173
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authen

    MediumCVSS 6.8No exploitEPSS 0%

    simplemachines · smfOct 24, 2011

  • CVE-2019-12490
    26Monitor

    An issue was discovered in Simple Machines Forum (SMF) before 2.0.16.

    MediumCVSS 6.5No exploitEPSS 1%

    simplemachines · simple machines forumJan 22, 2020

  • CVE-2013-4395
    24Monitor

    Simple Machines Forum (SMF) through 2.0.5 has XSS

    MediumCVSS 6.1No exploitEPSS 0%

    simplemachines · simple machines forumFeb 12, 2020

  • CVE-2013-7467
    24Monitor

    Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.

    MediumCVSS 6.1No exploitEPSS 0%

    simplemachines · simple machines forumMar 7, 2019

  • CVE-2025-67163
    24Monitor

    A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML

    MediumCVSS 6.1No exploitEPSS 0%

    simplemachines · simple machines forumDec 18, 2025

  • CVE-2024-7438
    21Monitor

    SimpleMachines SMF User Alert Read Status index.php resource injection

    MediumCVSS 5.3No exploitEPSS 0%

    simplemachines · simple machines forumAug 3, 2024

  • CVE-2024-7437
    21Monitor

    SimpleMachines SMF Delete User index.php resource injection

    MediumCVSS 5.3No exploitEPSS 0%

    simplemachines · simple machines forumAug 3, 2024

  • CVE-2013-0192
    20Monitor

    File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.

    MediumCVSS 4.9Proof of conceptEPSS 3%

    simplemachines · simple machines forumFeb 7, 2020

  • CVE-2011-1131
    20Monitor

    The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a

    MediumCVSS 5.0No exploitEPSS 1%

    simplemachines · smfJun 20, 2011