Ilia Alshanetsky : Security Vulnerabilities, CVEs, CVSS score >= 3
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
Max CVSS
7.5
EPSS Score
2.23%
Published
2005-09-02
Updated
2018-10-19
FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter.
Max CVSS
5.0
EPSS Score
1.29%
Published
2005-08-17
Updated
2008-09-05
tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
Max CVSS
5.0
EPSS Score
1.91%
Published
2003-04-11
Updated
2008-09-05
admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters.
Max CVSS
5.0
EPSS Score
2.14%
Published
2003-04-11
Updated
2008-09-05
SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
Max CVSS
7.5
EPSS Score
0.22%
Published
2003-04-11
Updated
2008-09-05
5 vulnerabilities found