SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform…
Priority LOW 37Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
Why it matters now
EPSS 0.02129 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:* | 1.2.8 | Vulnerable | Ilia Alshanetsky |
| cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:* | 1.9.8 | Vulnerable | Ilia Alshanetsky |
| cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Vulnerable | Ilia Alshanetsky |
- cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Ilia Alshanetsky
- cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Ilia Alshanetsky
- cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Ilia Alshanetsky
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2002-1421
- 2026-10-03 Alias added: GHSA-xg9x-3893-67r8
References
More Ilia Alshanetsky Fudforum vulnerabilities
- TI-2005-02642 The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded… CVSS 2.0HIGH 7.5
- TI-2002-01344 admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files… CVSS 2.0MEDIUM 5.0
- TI-2002-01345 tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via… CVSS 2.0MEDIUM 5.0
- TI-2005-02464 FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware… CVSS 2.0MEDIUM 5.0
- TI-2013-04547 Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in… CVSS 2.0LOW 2.6
Sources
- CVE-2002-1421 · CVE Program
- CVE-2002-1421 · NVD
- FIRST EPSS
- GHSA-xg9x-3893-67r8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences