Ultimate Php Board
Approved changes feed: RSS · Atom
cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.9:*:*:*:*:*:*:*part: a version: 1.9 update: *
| Vendor | Ultimate Php Board (5b3b2f51-8b7a-5276-bdc8-10c884e7852f) |
|---|---|
| Product | Ultimate Php Board (9b310a16-ab8a-573f-8dc6-ca98a8847099) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/php-outburst/myupb |
purl2cpe | 2026-06-01 10:15:55.446437 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2006-3208 |
vulnerable | 2026-06-08 04:49:08.539500 |
Details available
Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.
Published: 2006-06-24T01:00:00.000Z
Updated: 2024-08-07T18:23:20.171Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-3207 |
vulnerable | 2026-06-08 04:49:08.539125 |
Details available
Directory traversal vulnerability in newpost.php in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the id parameter, as demonstrated by injecting a Perl CGI script using "[NR]" sequences in the message parameter, then calling close.php with modified id and t_id parameters to chmod the script. NOTE: this issue might be resultant from dynamic variable evaluation.
Published: 2006-06-24T01:00:00.000Z
Updated: 2024-08-07T18:23:20.116Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-3206 |
vulnerable | 2026-06-08 04:49:08.538807 |
Details available
register.php in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to create arbitrary accounts via the "[NR]" sequence in the signature field, which is used to separate multiple records.
Published: 2006-06-24T01:00:00.000Z
Updated: 2024-08-07T18:23:21.168Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-3205 |
vulnerable | 2026-06-08 04:49:08.538460 |
Details available
Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to gain access via modified user_env, pass_env, power_env, and id_env parameters in a cookie, which comprise a persistent logon that does not vary across sessions.
Published: 2006-06-24T01:00:00.000Z
Updated: 2024-08-07T18:23:21.172Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-3204 |
vulnerable | 2026-06-08 04:49:08.538075 |
Details available
Ultimate PHP Board (UPB) 1.9.6 and earlier uses a cryptographically weak block cipher with a large key collision space, which allows remote attackers to determine a suitable decryption key given the plaintext and ciphertext by obtaining the plaintext password, which is sent when logging in, and the ciphertext, which is set in the pass_env cookie.
Published: 2006-06-24T01:00:00.000Z
Updated: 2024-08-07T18:23:21.206Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-3203 |
vulnerable | 2026-06-08 04:49:08.536760 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-2030 |
vulnerable | 2026-06-08 04:48:28.139709 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-2005 |
vulnerable | 2026-06-08 04:48:28.066000 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-2004 |
vulnerable | 2026-06-08 04:48:28.065657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-1616 |
vulnerable | 2026-06-08 04:48:27.021743 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-1615 |
vulnerable | 2026-06-08 04:48:27.021419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-1614 |
vulnerable | 2026-06-08 04:48:27.019885 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.