| CVE-2018-18668 | MEDIO6.1 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter. | 26/08/2019 |
| CVE-2017-18572 | MEDIO6.1 | The gnucommerce plugin before 1.4.2 for WordPress has XSS. | 22/08/2019 |
| CVE-2016-10920 | MEDIO6.1 | The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS. | 22/08/2019 |
| CVE-2018-18676 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/board_form_update.php bo_mobile_content_tail parameter. | 23/07/2019 |
| CVE-2018-18675 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/board_form_update.php bo_mobile_subject parameter. | 23/07/2019 |
| CVE-2018-18672 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/board_form_update.php bo_content_head parameter. | 23/07/2019 |
| CVE-2018-18670 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter, aka the adm/config_form_update.php cf_1~10 parameter. | 23/07/2019 |
| CVE-2018-18673 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menu_list_update.php me_link parameter. | 23/07/2019 |
| CVE-2018-18671 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/board_form_update.php bo_mobile_content_head parameter. | 23/07/2019 |
| CVE-2018-18669 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/board_form_update.php bo_subject parameter. | 23/07/2019 |
| CVE-2018-15584 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | 26/04/2019 |
| CVE-2018-15582 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | 26/04/2019 |
| CVE-2018-15581 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | 26/04/2019 |
| CVE-2018-15580 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | 26/04/2019 |
| CVE-2018-15585 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. | 27/03/2019 |
| CVE-2018-15583 | MEDIO6.1 | Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. | 25/03/2019 |
| CVE-2014-2339 | MEDIO6.5 | Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter. | 19/03/2014 |
| CVE-2012-4873 | MEDIO4.3 | Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter. | 06/09/2012 |
| CVE-2011-4066 | ALTO7.5 | SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. | 04/11/2011 |
| CVE-2009-0290 | MEDIO6.8 | Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname. | 27/01/2009 |