CVE-2005-3686
HighSummary
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before version 1.5.3 Patch 4 allows remote attackers to execute arbitrary SQL commands via the DateFrom or DateUntil parameters to forum.php.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify sensitive data, and potentially take control of the server.
Recommendation
Immediately update Unclassified NewsBoard to version 1.5.3 Patch 4 or later, which includes a fix for the SQL injection vulnerability.
Related vulnerabilities
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
- CVE-2026-112857Critical
The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.
- CVE-2026-112856Critical
The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.
- CVE-2026-112855Critical
The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.
- CVE-2026-112854Critical
The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.
- CVE-2026-112853Critical
The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.
- CVE-2026-112851Critical
The HotLock WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects HotLock from n/a through 1.3.9.
- CVE-2026-112848Critical
A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.
Original NVD description (English source)
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before 1.5.3 Patch 4 allows remote attackers to execute arbitrary SQL commands via the (1) DateFrom or (2) DateUntil parameter to forum.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS