Phpbb
40 CVEs tracked since 2006. Since Oct 2006, none of them reached CISA KEV.
Phpbb CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2006-10 | 8 | 0 |
| 2006-11 | null or fewer | |
| 2006-12 | 2 | 0 |
| 2007-01 | null or fewer | |
| 2007-02 | 2 | 0 |
| 2007-03 | 5 | 0 |
| 2007-04 | null or fewer | |
| 2007-05 | null or fewer | |
| 2007-06 | null or fewer | |
| 2007-07 | null or fewer | |
| 2007-08 | null or fewer | |
| 2007-09 | 2 | 0 |
| 2007-10 | 6 | 0 |
| 2007-11 | null or fewer | |
| 2007-12 | 1 | 0 |
| 2008-01 | null or fewer | |
| 2008-02 | null or fewer | |
| 2008-03 | 3 | 0 |
| 2008-04 | null or fewer | |
| 2008-05 | null or fewer | |
| 2008-06 | null or fewer | |
| 2008-07 | null or fewer | |
| 2008-08 | null or fewer | |
| 2008-09 | 1 | 0 |
| 2008-10 | null or fewer | |
| 2008-11 | null or fewer | |
| 2008-12 | null or fewer | |
| 2009-01 | null or fewer | |
| 2009-02 | null or fewer | |
| 2009-03 | 2 | 0 |
| 2009-04 | null or fewer | |
| 2009-05 | null or fewer | |
| 2009-06 | null or fewer | |
| 2009-07 | null or fewer | |
| 2009-08 | null or fewer | |
| 2009-09 | null or fewer | |
| 2009-10 | null or fewer | |
| 2009-11 | null or fewer | |
| 2009-12 | null or fewer | |
| 2010-01 | null or fewer | |
| 2010-02 | null or fewer | |
| 2010-03 | null or fewer | |
| 2010-04 | null or fewer | |
| 2010-05 | 2 | 0 |
| 2010-06 | null or fewer | |
| 2010-07 | null or fewer | |
| 2010-08 | null or fewer | |
| 2010-09 | null or fewer | |
| 2010-10 | null or fewer | |
| 2010-11 | null or fewer | |
| 2010-12 | null or fewer | |
| 2011-01 | null or fewer | |
| 2011-02 | null or fewer | |
| 2011-03 | null or fewer | |
| 2011-04 | null or fewer | |
| 2011-05 | null or fewer | |
| 2011-06 | null or fewer | |
| 2011-07 | null or fewer | |
| 2011-08 | null or fewer | |
| 2011-09 | null or fewer | |
| 2011-10 | null or fewer | |
| 2011-11 | null or fewer | |
| 2011-12 | null or fewer | |
| 2012-01 | null or fewer | |
| 2012-02 | null or fewer | |
| 2012-03 | null or fewer | |
| 2012-04 | null or fewer | |
| 2012-05 | null or fewer | |
| 2012-06 | null or fewer | |
| 2012-07 | null or fewer | |
| 2012-08 | null or fewer | |
| 2012-09 | null or fewer | |
| 2012-10 | null or fewer | |
| 2012-11 | null or fewer | |
| 2012-12 | null or fewer | |
| 2013-01 | null or fewer | |
| 2013-02 | null or fewer | |
| 2013-03 | null or fewer | |
| 2013-04 | null or fewer | |
| 2013-05 | null or fewer | |
| 2013-06 | null or fewer | |
| 2013-07 | null or fewer | |
| 2013-08 | null or fewer | |
| 2013-09 | null or fewer | |
| 2013-10 | null or fewer | |
| 2013-11 | null or fewer | |
| 2013-12 | null or fewer | |
| 2014-01 | null or fewer | |
| 2014-02 | null or fewer | |
| 2014-03 | null or fewer | |
| 2014-04 | null or fewer | |
| 2014-05 | null or fewer | |
| 2014-06 | null or fewer | |
| 2014-07 | null or fewer | |
| 2014-08 | null or fewer | |
| 2014-09 | null or fewer | |
| 2014-10 | null or fewer | |
| 2014-11 | null or fewer | |
| 2014-12 | null or fewer | |
| 2015-01 | null or fewer | |
| 2015-02 | 2 | 0 |
| 2015-03 | null or fewer | |
| 2015-04 | null or fewer | |
| 2015-05 | null or fewer | |
| 2015-06 | null or fewer | |
| 2015-07 | null or fewer | |
| 2015-08 | null or fewer | |
| 2015-09 | null or fewer | |
| 2015-10 | null or fewer | |
| 2015-11 | null or fewer | |
| 2015-12 | null or fewer | |
| 2016-01 | null or fewer | |
| 2016-02 | null or fewer | |
| 2016-03 | null or fewer | |
| 2016-04 | null or fewer | |
| 2016-05 | null or fewer | |
| 2016-06 | null or fewer | |
| 2016-07 | null or fewer | |
| 2016-08 | null or fewer | |
| 2016-09 | null or fewer | |
| 2016-10 | null or fewer | |
| 2016-11 | null or fewer | |
| 2016-12 | null or fewer | |
| 2017-01 | null or fewer | |
| 2017-02 | null or fewer | |
| 2017-03 | null or fewer | |
| 2017-04 | null or fewer | |
| 2017-05 | null or fewer | |
| 2017-06 | null or fewer | |
| 2017-07 | null or fewer | |
| 2017-08 | null or fewer | |
| 2017-09 | null or fewer | |
| 2017-10 | null or fewer | |
| 2017-11 | null or fewer | |
| 2017-12 | null or fewer | |
| 2018-01 | null or fewer | |
| 2018-02 | null or fewer | |
| 2018-03 | null or fewer | |
| 2018-04 | null or fewer | |
| 2018-05 | null or fewer | |
| 2018-06 | null or fewer | |
| 2018-07 | null or fewer | |
| 2018-08 | null or fewer | |
| 2018-09 | null or fewer | |
| 2018-10 | null or fewer | |
| 2018-11 | null or fewer | |
| 2018-12 | null or fewer | |
| 2019-01 | null or fewer | |
| 2019-02 | null or fewer | |
| 2019-03 | null or fewer | |
| 2019-04 | null or fewer | |
| 2019-05 | 2 | 0 |
| 2019-06 | null or fewer | |
| 2019-07 | null or fewer | |
| 2019-08 | null or fewer | |
| 2019-09 | 2 | 0 |
Products
The products that kept showing up in Phpbb's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Phpbb.
- CVE-2026-48611Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.9.8
- CVE-2026-48612Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. ...8.0
- CVE-2026-48613SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies...5.9
- CVE-2026-47366Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level au...7.2
- CVE-2026-29199phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Hos...8.1
- CVE-2025-70811Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.4.3
- CVE-2025-70810Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism8.8
- CVE-2023-5917phpBB Smiley Pack acp_icons.php main cross site scripting2.4
- CVE-2020-8226A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.5.8
- CVE-2019-16108phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.7.5
- CVE-2019-16107Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.4.3
- CVE-2020-5502phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.6.5
- CVE-2020-5501phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.4.3
- CVE-2011-0544phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.6.1
- CVE-2019-16993In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an att...8.8
The record
- Peak rank
- #5 in Oct 2006
- Busiest month shown
- Oct 2006, 8 CVEs
- Months with a KEV entry
- 0 since Oct 2006
- Monthly snapshots
- 14 since 2006