FluxBB vulnerabilities

4 known CVE vulnerabilities in FluxBB, translated and rated.

CVE-2014-9574High
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
CVE-2014-10029High
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
CVE-2021-43677Medium
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
CVE-2020-28873High
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS