← Back

Gnuboard

gnuboard

Vendor: Sir • 39 CVEs

CVEs (39)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-60859
1Sir
1Gnuboard
Oct 28, 2025
Oct 23, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php.
CVE-2025-61464
1Sir
1Gnuboard
Oct 30, 2025
Oct 23, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.
CVE-2025-7786
1Sir
1Gnuboard
Apr 29, 2026
Jul 18, 2025
2.0 LOW· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. Th...Show more
A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2024-37658
1Sir
1Gnuboard
Jul 10, 2025
Jul 7, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
CVE-2024-37657
1Sir
1Gnuboard
Jul 10, 2025
Jul 7, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
CVE-2024-37656
1Sir
1Gnuboard
Jul 10, 2025
Jul 7, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.
CVE-2024-39097
1Sir
1Gnuboard
Jan 26, 2026
Aug 26, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path.
CVE-2024-41475
1Sir
1Gnuboard
Sep 18, 2024
Aug 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.
CVE-2024-24157
1Sir
1Gnuboard
Sep 2, 2025
May 14, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py.
CVE-2024-24156
1Sir
1Gnuboard
Sep 4, 2025
Mar 16, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter.
CVE-2022-44216
1Sir
1Gnuboard
Mar 18, 2025
Feb 20, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password.
CVE-2022-3963
1Sir
1Gnuboard
Nov 21, 2024
Nov 12, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to...Show more
A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540.Show less
CVE-2022-30050
1Sir
1Gnuboard
Nov 21, 2024
May 16, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
CVE-2022-1252
1Sir
1Gnuboard
Feb 24, 2026
Apr 11, 2022
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive inf...Show more
Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contentsShow less
CVE-2020-18663
1Sir
1Gnuboard
Nov 21, 2024
Jun 24, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
CVE-2020-18662
1Sir
1Gnuboard
Nov 21, 2024
Jun 24, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
CVE-2020-18661
1Sir
1Gnuboard
Nov 21, 2024
Jun 24, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
CVE-2018-18674
1Sir
1Gnuboard
Nov 21, 2024
Nov 7, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter.
CVE-2018-18678
1Sir
1Gnuboard
Nov 21, 2024
Oct 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
CVE-2018-18668
1Sir
1Gnuboard
Nov 21, 2024
Aug 26, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.