phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement."

Description

References

• nvd.nist.gov/vuln/detail/CVE-2010-1630 · ADVISORY
• phpbb/phpbb-app commit 1758aa3 · WEB
• phpbb/phpbb-app · PACKAGE
• phpbb/phpbb3 commit 4ea3402 · WEB
• openwall.com/lists/oss-security/2010/05/16/1 · WEB
• openwall.com/lists/oss-security/2010/05/18/12 · WEB
• openwall.com/lists/oss-security/2010/05/19/5 · WEB
• phpbb.com/community/viewtopic.php · WEB

Mais vulnerabilidades de phpbb/phpbb

• CVE-2026-29199ALTO 8.1phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled…
• CVE-2023-5917MÉDIO 6.1A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file…
• CVE-2020-8226MÉDIO 5.8A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
• CVE-2019-16108ALTO 7.5phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
• CVE-2019-16107MÉDIO 4.3Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.