GCVE - cpe:2.3:a:ralph_capper:tinyphpforum:3.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ralph_capper:tinyphpforum:3.6:*:*:*:*:*:*:*

part: a version: 3.6 update: *

Vendor	Ralph Capper (`3a4939df-b9b2-5bab-8861-d607552f3abc`)
Product	Tinyphpforum (`411e92a5-057a-5198-89f9-9acd90eb441b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:sourceforge/tinyphpforum`	purl2cpe	2026-06-01 10:15:26.371703

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2006-1898`	vulnerable	2026-06-08 04:48:58.331775	Details available Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103. Published: 2006-04-20T10:00:00.000Z Updated: 2024-08-07T17:27:29.454Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/25856 http://securityreason.com/securityalert/728 http://www.securityfocus.com/bid/17553 http://securityreason.com/securityalert/773 http://www.securityfocus.com/archive/1/431133/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0104`	vulnerable	2026-06-08 04:48:45.952897	Details available Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php. Published: 2006-01-06T11:00:00.000Z Updated: 2024-08-07T16:25:32.863Z Open on db.gcve.eu Reference links http://evuln.com/vulns/14/exploit.html http://securitytracker.com/id?1015436 http://www.securityfocus.com/archive/1/420933/100/0/threaded http://www.vupen.com/english/advisories/2006/0054 http://secunia.com/advisories/18293	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0103`	vulnerable	2026-06-08 04:48:45.952417	Details available TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information. Published: 2006-01-06T11:00:00.000Z Updated: 2024-08-07T16:25:33.503Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1015436 http://www.securityfocus.com/archive/1/420933/100/0/threaded http://www.osvdb.org/22257 http://www.vupen.com/english/advisories/2006/0054 http://secunia.com/advisories/18293	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0102`	vulnerable	2026-06-08 04:48:45.949249	Details available Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php. Published: 2006-01-06T11:00:00.000Z Updated: 2024-08-07T16:25:32.865Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1015436 http://www.osvdb.org/22256 http://www.securityfocus.com/archive/1/420933/100/0/threaded http://www.vupen.com/english/advisories/2006/0054 http://secunia.com/advisories/18293	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Tinyphpforum

Notes

PURL mappings

Vulnerability references

Contribute