CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/04/2009 |
| CVE-2008-6657 | MÉDIO6.8 | Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action. | 07/04/2009 |
| CVE-2008-6544 | ALTO7.5 | Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) settings[default_theme_dir] parameter to Sources/Subs-Graphics.php and (2) settings[default_theme_dir] parameter to Sources/Themes.php. NOTE: CVE and multipl | 30/03/2009 |
| CVE-2008-3073 | ALTO7.5 | Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13 has unknown impact and attack vectors, probably cross-site scripting (XSS), related to "use of the html-tag." | 08/07/2008 |
| CVE-2008-3072 | ALTO7.5 | Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13, when running in PHP before 4.2.0, does not properly seed the random number generator, which has unknown impact and attack vectors. | 08/07/2008 |
| CVE-2007-5943 | MÉDIO5.0 | Simple Machines Forum (SMF) 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message. | 14/11/2007 |
| CVE-2007-5646 | MÉDIO6.8 | SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php. | 23/10/2007 |
| CVE-2007-3942 | MÉDIO5.8 | Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.1.3 allows remote attackers to include local files via unspecified vectors related to the sourcedir parameter or the actionArray hash. NOTE: CVE and multiple third parties dispute this vulnerability because both sourcedir and actionArray a | 21/07/2007 |
| CVE-2007-3309 | ALTO7.5 | Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.2 allows remote attackers to execute arbitrary PHP code during (1) creation or (2) editing of a message. | 21/06/2007 |
| CVE-2007-3308 | ALTO7.5 | Simple Machines Forum (SMF) 1.1.2 uses a concatenation method with insufficient randomization when creating a WAV file CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated brute-force attack. | 21/06/2007 |
| CVE-2007-2546 | MÉDIO6.8 | Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | 09/05/2007 |
| CVE-2006-7013 | ALTO7.5 | QueryString.php in Simple Machines Forum (SMF) 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address. NOTE: the original researcher | 15/02/2007 |
| CVE-2007-0399 | MÉDIO6.0 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action. | 22/01/2007 |
| CVE-2006-5504 | MÉDIO4.3 | Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter. | 25/10/2006 |
| CVE-2006-5503 | MÉDIO4.3 | Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter. | 25/10/2006 |
| CVE-2006-4467 | ALTO7.5 | Simple Machines Forum (SMF) 1.1RCx before 1.1RC3, and 1.0.x before 1.0.8, does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to perform directory traversal attacks to read arbitrary local files, l | 31/08/2006 |
| CVE-2006-0896 | MÉDIO4.3 | Cross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field. | 25/02/2006 |
| CVE-2005-4159 | ALTO7.5 | NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. NOTE: the vendor says that since only one character can be modified, th | 11/12/2005 |