Skip to content
OpenAdvisories
High DLA-1942-2 2 CVEs

phpbb3 - security update

Published Oct 6, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 phpbb3 3.0.12-5+deb8u4

Vulnerabilities 2

  • High 8.8
    CVE-2019-16993

    phpBB Cross-Site Request Forgery (CSRF)

    In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthentic…

    phpbb/phpbb phpbb3 Ubuntu Packagist
  • Medium 6.5
    CVE-2019-13376

    phpBB Cross-Site Request Forgery (CSRF)

    phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

    phpbb/phpbb phpbb3 Ubuntu Packagist