Simplemachines: Security Vulnerabilities
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.
CVSS Score
9.8
EPSS Score
0.003
Published
2020-01-15
Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the db_type parameter if install.php remains present after installation.
CVSS Score
8.8
EPSS Score
0.019
Published
2019-03-07
Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-03-07
Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter.
CVSS Score
8.1
EPSS Score
0.005
Published
2019-03-07
The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users variable in a query, which might allow attackers to bypass intended access restrictions.
CVSS Score
9.8
EPSS Score
0.004
Published
2018-04-24
Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
CVSS Score
9.8
EPSS Score
0.008
Published
2017-02-09
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
CVSS Score
8.8
EPSS Score
0.006
Published
2017-02-09
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
CVSS Score
4.3
EPSS Score
0.004
Published
2014-04-29
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters characters.
CVSS Score
7.5
EPSS Score
0.007
Published
2014-04-29
Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
CVSS Score
7.5
EPSS Score
0.006
Published
2014-04-29