Skip to content
OpenAdvisories

Product · phpBB

phpBB

6 known vulnerabilities.

All Critical High Medium Low Exploited only

6 results · Feed

  • High 8.3
    CVE-2026-87901

    Improper sanitization in the registration module allows reflected Cross-Site Scripting.

    phpBB phpBB
  • High 8.0
    CVE-2026-48612

    Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow a…

    phpBB phpBB
  • High 7.1
    CVE-2026-48613

    SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field da…

    phpBB phpBB
  • Critical 9.8
    CVE-2026-48611

    Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or…

    phpBB phpBB
  • High 7.2
    CVE-2026-47366

    Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) a…

    phpBB phpBB
  • High 8.1
    CVE-2026-29199

    phpBB has Password Reset Link Poisoning via Host Header injection

    phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL…

    phpBB phpBB phpbb/phpbb Packagist