phpBB vulnerabilities
6 published CVEs name phpBB among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-87901
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
phpBB · phpBB
High8.3 - CVE-2026-48613
SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution…
phpBB · phpBB
High7.1 - CVE-2026-48612
Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked…
phpBB · phpBB
High8.0 - CVE-2026-47366
Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to…
phpBB · phpBB
High7.2 - CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access…
phpBB · phpBB
Critical9.8 - CVE-2026-29199
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers…
phpBB · phpBB
High8.1