Total
6 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2013-5309 | 2 Fudforum, Ilia Alshanetsky | 2 Fudforum, Fudforum | 2024-11-21 | 2.6 LOW | N/A |
| Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2005-2781 | 1 Ilia Alshanetsky | 1 Fudforum | 2024-11-21 | 7.5 HIGH | N/A |
| The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code. | |||||
| CVE-2005-2600 | 1 Ilia Alshanetsky | 1 Fudforum | 2024-11-20 | 5.0 MEDIUM | N/A |
| FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter. | |||||
| CVE-2002-1423 | 1 Ilia Alshanetsky | 1 Fudforum | 2024-11-20 | 5.0 MEDIUM | N/A |
| tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter. | |||||
| CVE-2002-1422 | 1 Ilia Alshanetsky | 1 Fudforum | 2024-11-20 | 5.0 MEDIUM | N/A |
| admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters. | |||||
| CVE-2002-1421 | 1 Ilia Alshanetsky | 1 Fudforum | 2024-11-20 | 7.5 HIGH | N/A |
| SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php. | |||||