GCVE - cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*

part: a version: 2.0 update: rc2

Vendor	Simplemachines (`ed17b814-802e-5af3-8d89-bced900c1e5b`)
Product	Smf (`3e11becd-38d0-5e75-a9f5-97322e1ef793`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/simplemachines/smf`	purl2cpe	2026-06-01 10:16:19.482737

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-4173`	vulnerable	2026-06-08 04:59:29.785170	Details available Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information. Published: 2011-10-24T18:00:00.000Z Updated: 2024-09-16T19:25:53.265Z Open on db.gcve.eu Reference links http://secunia.com/advisories/46386 http://openwall.com/lists/oss-security/2011/10/10/6 http://openwall.com/lists/oss-security/2011/10/09/3 http://www.simplemachines.org/community/index.php?topic=452888.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3615`	vulnerable	2026-06-08 04:59:26.657274	Details available Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information. Published: 2011-10-24T17:00:00.000Z Updated: 2024-08-06T23:37:48.639Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/70617 http://secunia.com/advisories/46386 http://openwall.com/lists/oss-security/2011/10/10/6 http://openwall.com/lists/oss-security/2011/10/09/3 http://www.simplemachines.org/community/index.php?topic=452888.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1131`	vulnerable	2026-06-08 04:57:55.839133	Details available The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search. Published: 2011-06-21T01:00:00.000Z Updated: 2024-09-16T16:23:54.287Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.simplemachines.org/community/index.php?topic=421547.0 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1130`	vulnerable	2026-06-08 04:57:55.835831	Details available Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php. Published: 2011-06-21T01:00:00.000Z Updated: 2024-09-16T17:15:00.759Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.simplemachines.org/community/index.php?topic=421547.0 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1129`	vulnerable	2026-06-08 04:57:55.832015	Details available Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action. Published: 2011-06-21T01:00:00.000Z Updated: 2024-09-16T20:37:33.702Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.simplemachines.org/community/index.php?topic=421547.0 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1128`	vulnerable	2026-06-08 04:57:55.828375	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1127`	vulnerable	2026-06-08 04:57:55.823928	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.