Phpbb CVE-2020-5501

Account hijacking in phpBB is possible due to improper authentication checks in the OAuth implementation, affecting defa

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote A

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in

Host header injection in phpBB versions 3.0.0 through 3.3.15 enables password reset link poisoning when force_server_var

Account takeover in phpBB via OAuth state-verification flaw enables remote attackers to link a victim's forum account to

The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Rated high severity (CVSS 7.5), this vulne

Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions

The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the fo

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Rated medium severity (CVSS 6.5), this vuln

Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of G

A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.php of the component Smiley P