Read the docs
TI-2011-00981 Aliases CVE-2011-1128GHSA-gw9p-924j-qxp9

The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13…

Priority LOW 36CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack.

Why it matters now

EPSS 0.01596 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*up to 1.1.12VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*1.0VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*1.0 beta4VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*1.0 beta4.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*1.0 beta5VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*1.0 beta6VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*1.0 rc2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableSimpleMachines
  • cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:* Versions up to 1.1.12 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:* Versions 1.0 beta4 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:* Versions 1.0 beta4.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:* Versions 1.0 beta5 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:* Versions 1.0 beta6 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·SimpleMachines
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*1.0.7VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*1.0.8VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*1.0.9VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*1.0.10VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*1.0.12VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*1.0.13VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*1.0.14VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*1.0.15VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*1.0.16VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*1.0.17VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*1.0.18VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*1.0.19VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*1.0.20VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*1.0.21VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*1.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*1.1 beta1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*1.1 beta2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*1.1 beta3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*1.1 beta4VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*1.1 rc1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*1.1 rc2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*1.1 rc3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*1.1.7VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*1.1.8VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*1.1.9VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*1.1.10VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*1.1.11VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*2.0 beta1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*2.0 beta2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*2.0 beta2.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*2.0 beta3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*2.0 beta3.1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*2.0 beta4VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*2.0 rc1VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*2.0 rc2VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*2.0 rc3VulnerableSimpleMachines
cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*2.0 rc4VulnerableSimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:* Versions 1.0.7 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:* Versions 1.0.8 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:* Versions 1.0.9 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:* Versions 1.0.10 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:* Versions 1.0.12 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:* Versions 1.0.13 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:* Versions 1.0.14 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:* Versions 1.0.15 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:* Versions 1.0.16 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:* Versions 1.0.17 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:* Versions 1.0.18 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:* Versions 1.0.19 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:* Versions 1.0.20 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:* Versions 1.0.21 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:* Versions 1.1 beta1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:* Versions 1.1 beta2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:* Versions 1.1 beta3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:* Versions 1.1 beta4 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:* Versions 1.1 rc2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:* Versions 1.1 rc3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:* Versions 1.1.7 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:* Versions 1.1.8 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:* Versions 1.1.9 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:* Versions 1.1.10 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:* Versions 1.1.11 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:* Versions 2.0 beta1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:* Versions 2.0 beta2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:* Versions 2.0 beta2.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:* Versions 2.0 beta3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:* Versions 2.0 beta3.1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:* Versions 2.0 beta4 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:* Versions 2.0 rc1 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:* Versions 2.0 rc2 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:* Versions 2.0 rc3 Vulnerable ·SimpleMachines
  • cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:* Versions 2.0 rc4 Vulnerable ·SimpleMachines

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1128
  2. 2026-10-03 Alias added: GHSA-gw9p-924j-qxp9

References

Patch 4

  • TI-2011-00980 SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not… CVSS 2.0HIGH 10.0
  • TI-2008-06659 The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14… CVSS 2.0HIGH 7.5
  • TI-2011-03189 Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and… CVSS 2.0HIGH 7.5
  • TI-2011-00983 Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly… CVSS 2.0HIGH 7.5
  • TI-2011-03682 Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before… CVSS 2.0MEDIUM 6.8
  • TI-2011-00984 The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and… CVSS 2.0MEDIUM 5.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences