GCVE - cpe:2.3:a:woltlab:burning_board_lite:1.0.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:woltlab:burning_board_lite:1.0.2:*:*:*:*:*:*:*

part: a version: 1.0.2 update: *

Vendor	Woltlab (`5736b72c-8a73-577e-86c5-6f79c04cb330`)
Product	Burning Board Lite (`195e7f2a-e709-5ad6-8f57-253dea3871e2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/woltlab/wcf`	purl2cpe	2026-06-01 10:12:43.717887

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2007-6518`	vulnerable	2026-06-08 04:50:08.978850	Details available Multiple SQL injection vulnerabilities in search.php in WoltLab Burning Board (wBB) Lite 1.0.2 pl3e allow remote attackers to execute arbitrary SQL commands via the (1) showposts, (2) sortby, and (3) sortorder parameters. Published: 2007-12-24T20:00:00.000Z Updated: 2024-08-07T16:11:05.709Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/39174 http://www.securityfocus.com/archive/1/485408/100/0/threaded http://www.vupen.com/english/advisories/2007/4300 http://secunia.com/advisories/28188 http://www.securityfocus.com/bid/26973	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-0812`	vulnerable	2026-06-08 04:49:33.433861	Details available SQL injection vulnerability in pms.php in Woltlab Burning Board (wBB) Lite 1.0.2pl3e and earlier allows remote authenticated users to execute arbitrary SQL commands via the pmid[0] parameter. Published: 2007-02-07T11:00:00.000Z Updated: 2024-08-07T12:34:21.124Z Open on db.gcve.eu Reference links http://secunia.com/advisories/24027 https://exchange.xforce.ibmcloud.com/vulnerabilities/32172 http://www.securityfocus.com/bid/22415 http://www.vupen.com/english/advisories/2007/0491 https://www.exploit-db.com/exploits/3262	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-6289`	vulnerable	2026-06-08 04:49:28.545725	Details available Woltlab Burning Board (wBB) Lite 1.0.2 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the wbb_userid parameter to the top-level URI. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in wBB Lite. Published: 2006-12-05T11:00:00.000Z Updated: 2024-08-07T20:19:35.134Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/21265 http://retrogod.altervista.org/wbblite_102_sql.html http://www.securityfocus.com/archive/1/452561/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-6237`	vulnerable	2026-06-08 04:49:22.355516	Details available SQL injection vulnerability in the decode_cookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remote attackers to execute arbitrary SQL commands via the threadvisit Cookie parameter. Published: 2006-12-03T18:00:00.000Z Updated: 2024-08-07T20:19:35.015Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2006/4694 https://exchange.xforce.ibmcloud.com/vulnerabilities/30561 http://retrogod.altervista.org/wbblite_102_sql_mqg_bypass.html https://www.exploit-db.com/exploits/2841 http://securityreason.com/securityalert/1955	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.