VendorsSIRgnuboardany version
Vulnerabilities

SIR GNUBoard any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

22CVEs
CVE-2020-18662
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
Published 2021-06-24 · Modified
9.81 PoCEPSS 0.054
CVE-2005-0269
The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters.
Published 2005-02-10 · Modified
9.8EPSS 0.026
CVE-2022-1252
Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5
Published 2022-04-11 · Modified
9.1EPSS 0.005
CVE-2011-4066
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
Published 2011-11-04 · Modified
7.51 PoCEPSS 0.016
CVE-2014-2339
Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
Published 2014-03-19 · Modified
6.51 PoCEPSS 0.020
CVE-2025-61464
gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.
Published 2025-10-23 · Analyzed
6.5EPSS 0.002
CVE-2018-15585
Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Published 2019-03-27 · Modified
6.1EPSS 0.015
CVE-2018-18668
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.
Published 2019-08-26 · Modified
6.1EPSS 0.014
CVE-2020-18661
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
Published 2021-06-24 · Modified
6.1EPSS 0.011
CVE-2018-18678
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
Published 2019-10-30 · Modified
6.1EPSS 0.011
CVE-2018-15582
Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Published 2019-04-26 · Modified
6.1EPSS 0.011
CVE-2018-15583
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Published 2019-03-25 · Modified
6.1EPSS 0.011
CVE-2018-15580
Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Published 2019-04-26 · Modified
6.1EPSS 0.011
CVE-2018-15584
Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Published 2019-04-26 · Modified
6.1EPSS 0.011
CVE-2018-15581
Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Published 2019-04-26 · Modified
6.1EPSS 0.011
CVE-2020-18663
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
Published 2021-06-24 · Modified
6.1EPSS 0.011
CVE-2024-24156
Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter.
Published 2024-03-16 · Analyzed
6.1EPSS 0.005
CVE-2024-24157
Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py.
Published 2024-05-09 · Analyzed
6.1EPSS 0.004
CVE-2024-39097
There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path.
Published 2024-08-26 · Modified
6.1EPSS 0.004
CVE-2022-3963
gnuboard5 FAQ Key ID faq.php cross site scripting
Published 2022-11-12 · Modified
5.4EPSS 0.004
CVE-2025-7786
Gnuboard g6 Post Reply qa cross site scripting
Published 2025-07-18 · Analyzed
5.4EPSS 0.002
CVE-2012-4873
Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
Published 2012-09-06 · Modified
4.31 PoCEPSS 0.016