Ralph Capper: >> Tinyphpforum >> 3.48 Security Vulnerabilities
Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.
CVSS Score
4.3
EPSS Score
0.007
Published
2006-01-06
TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.
CVSS Score
5.0
EPSS Score
0.102
Published
2006-01-06
Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.
CVSS Score
5.0
EPSS Score
0.017
Published
2006-01-06