phpbb phpbb

Name: phpbb phpbb
Brand: phpbb

productUS

cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical13high22medium0low

updated 2026-10-28

vulnerabilities (38)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2001-1471US	high8.8	7.70% (95th)	Exploit	no fix	2001-07-31	≤ 1.4.0
CVE-2006-7168US	high7.5	7.40% (94th)	Exploit	no fix	2007-03-20	—
CVE-2006-5191US	medium5.1	3.15% (88th)	Exploit	no fix	2006-10-10	≤ 1.0
CVE-2007-5173US	medium6.8	2.80% (86th)	Exploit	no fix	2007-10-03	—
CVE-2002-2255US	medium4.3	1.44% (73rd)	Exploit	no fix	2002-12-31	= 2.0.3
CVE-2003-1530US	high7.5	1.06% (64th)	Exploit	no fix	2003-12-31	= 2.0.3
CVE-2007-4653US	high7.5	1.01% (63rd)	Exploit	no fix	2007-09-04	≤ 2.0.22
CVE-2007-5688US	high7.5	1.00% (63rd)	Exploit	no fix	2007-10-29	—
CVE-2018-19274US	high7.2	5.20% (92nd)	—	3.2.4	2018-11-17	< 3.2.4
CVE-2015-1431US	medium4.3	2.75% (86th)	—	no fix	2015-02-10	≤ 3.0.12
CVE-2015-3880US	medium6.1	2.05% (81st)	—	no fix	2017-09-19	6 versions
CVE-2019-9826US	high7.5	2.01% (81st)	—	no fix	2019-05-02	≤ 3.2.5
CVE-2008-4125US	medium5.0	1.63% (76th)	—	no fix	2008-09-18	= 2
CVE-2008-3224US	high10.0OT elevated	1.49% (74th)	—	no fix	2008-07-18	3 versions
CVE-2008-1766US	high10.0	1.49% (74th)	—	no fix	2008-04-12	3 versions
CVE-2002-2346US	medium5.0	1.39% (72nd)	—	no fix	2002-12-31	4 versions
CVE-2006-2220US	medium5.0	1.34% (71st)	—	no fix	2007-02-08	= 2.0.20
CVE-2017-1000419US	high7.5	1.32% (71st)	—	no fix	2018-01-02	= 3.2.0
CVE-2008-6506US	medium5.0	1.30% (70th)	—	no fix	2009-03-23	11 versions
CVE-2010-1630US	high7.5	1.23% (69th)	—	no fix	2010-05-19	5 versions
CVE-2019-11767US	medium5.8	1.18% (68th)	—	3.2.6	2019-05-05	< 3.2.6
CVE-2015-1432US	medium6.8	1.11% (66th)	—	no fix	2015-02-10	≤ 3.0.12
CVE-2010-1627US	medium4.3	1.11% (66th)	—	no fix	2010-05-19	= 3.0.7
CVE-2008-6507US	medium5.0	1.10% (65th)	—	no fix	2009-03-23	4 versions
CVE-2019-16108US	high7.5	1.08% (65th)	—	no fix	2020-03-20	= 3.2.7
CVE-2008-7143US	medium6.8	1.05% (64th)	—	no fix	2009-09-01	= 2.0.23
CVE-2020-8226US	medium5.8	0.97% (62nd)	—	3.2.10	2020-08-17	2 versions
CVE-2019-16993US	high8.8	0.80% (57th)	—	no fix	2019-09-30	≤ 3.1.7
CVE-2011-0544US	medium6.1	0.80% (56th)	—	no fix	2019-11-14	3.0.0 → 3.0.6
CVE-2019-13376US	medium6.5	0.68% (52nd)	—	no fix	2019-09-27	= 3.2.7
CVE-2008-0471US	medium4.3	0.63% (50th)	—	no fix	2008-01-29	= 2.0.22
CVE-2023-5917US	medium6.1	0.53% (44th)	—	3.3.11	2023-11-02	< 3.3.11
CVE-2020-5502US	medium6.5	0.43% (38th)	—	no fix	2020-01-15	= 3.2.8
CVE-2019-16107US	medium4.3	0.41% (36th)	—	no fix	2020-03-11	= 3.2.7
CVE-2020-5501US	medium4.3	0.38% (31st)	—	no fix	2020-01-15	= 3.2.8
CVE-2026-29199US	—	0.25% (16th)	—	3.3.16	2026-05-04	< 3.3.16
CVE-2025-70810US	—	0.25% (16th)	—	no fix	2026-04-09	= 3.3.15
CVE-2025-70811US	—	0.15% (4th)	—	no fix	2026-04-09	= 3.3.15

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-352Cross-Site Request Forgery (CSRF)9 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-264CWE-2642 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE38 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan