| CVE-2025-60859 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php. | 23/10/2025 |
| CVE-2025-61464 | MEDIO6.5 | gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php. | 23/10/2025 |
| CVE-2025-7786 | MEDIO5.4 | A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has | 18/07/2025 |
| CVE-2024-37658 | MEDIO6.1 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php. | 07/07/2025 |
| CVE-2024-37657 | MEDIO6.1 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component. | 07/07/2025 |
| CVE-2024-37656 | MEDIO6.1 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php. | 07/07/2025 |
| CVE-2024-39097 | MEDIO6.1 | There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path. | 26/08/2024 |
| CVE-2024-41475 | ALTO8.8 | Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration. | 12/08/2024 |
| CVE-2024-24157 | MEDIO6.1 | Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py. | 14/05/2024 |
| CVE-2024-24156 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter. | 16/03/2024 |
| CVE-2022-44216 | ALTO7.5 | Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password. | 20/02/2023 |
| CVE-2022-3963 | MEDIO5.4 | A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 i | 12/11/2022 |
| CVE-2022-30050 | MEDIO6.1 | Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php. | 16/05/2022 |
| CVE-2022-1252 | CRÍTICO9.1 | Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when t | 11/04/2022 |
| CVE-2020-18663 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php. | 24/06/2021 |
| CVE-2020-18662 | CRÍTICO9.8 | SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php. | 24/06/2021 |
| CVE-2020-18661 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php. | 24/06/2021 |
| CVE-2018-18674 | MEDIO6.1 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter. | 07/11/2019 |
| CVE-2018-18678 | MEDIO6.1 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter. | 30/10/2019 |
| CVE-2018-18668 | MEDIO6.1 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter. | 26/08/2019 |