Vulnerabilities

TI-2025-38016 CVE-2025-61540 · GHSA-5m3h-rr28-8rv6

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.

HIGH 70

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00291 Published 2025-10-16 No fix listed CWE-89

TI-2025-38015 CVE-2025-61539 · GHSA-3287-m53c-jw7m

Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.

MEDIUM 60

Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2025-10-16 No fix listed CWE-79

TI-2015-01975 CVE-2015-2217 · GHSA-m4q9-95cr-335x

Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB)…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar paramet…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01892 Published 2015-03-10 No fix listed CWE-79

TI-2003-00370 CVE-2003-0395 · GHSA-wf6v-m5v4-phr8

Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with…

LOW 38

Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administra…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02531 Published 2003-06-10 No fix listed CWE-94

Vulnerabilities

Filters

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.

Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.

Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB)…

Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with…