Vulnerabilities > Phorum
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2005-09-07 | CVE-2005-2836 | Cross-Site Scripting vulnerability in Phorum Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php. network phorum | 4.3 |
| 2005-05-02 | CVE-2005-0843 | Unspecified vulnerability in Phorum 5.0.14A CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header. | 5.0 |
| 2005-05-02 | CVE-2005-0784 | Subject and Attachment HTML Injection vulnerability in Phorum 5.0.14 Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user's personal control panel. network phorum | 4.3 |
| 2005-05-02 | CVE-2005-0783 | Subject and Attachment HTML Injection vulnerability in Phorum 5.0.14 Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file. network phorum | 4.3 |
| 2004-12-31 | CVE-2004-2243 | Remote Security vulnerability in Phorum 4.3.7 Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. | 7.5 |
| 2004-12-31 | CVE-2004-2242 | Cross-Site Scripting vulnerability in Phorum 5.0.7Beta Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter. network phorum | 4.3 |
| 2004-12-31 | CVE-2004-2241 | Cross-Site Scripting and SQL Injection vulnerability in Phorum 5.0.11 Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. network phorum | 4.3 |
| 2004-12-31 | CVE-2004-2240 | Cross-Site Scripting and SQL Injection vulnerability in Phorum 5.0.11 Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php. | 7.5 |
| 2004-12-31 | CVE-2004-2110 | SQL-Injection vulnerability in Phorum SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter. | 7.5 |
| 2004-12-31 | CVE-2004-1518 | SQL Injection vulnerability in Phorum FOLLOW.PHP SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter. | 4.6 |