HOMEVULNERABILITIESVENDORSPowie

PowieCVEs & Vulnerabilities

14 CVEs affecting Powie products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

14 CVEs→ All vendors

Most Affected Products

pforum 9pnews 3pfile 2php matchmaker 2pgb 2psys 2plink 1
CVE-2012-6524HIGHpoc

SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.

31 Jan 2013
7.5
CVSS
CVE-2012-1211MEDIUMpoc

Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.

24 Feb 2012
4.3
CVSS
CVE-2012-1210HIGHpoc

SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.

24 Feb 2012
7.5
CVSS
CVE-2008-5269HIGHpoc

SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.

28 Nov 2008
7.5
CVSS
CVE-2008-4357HIGHpoc

SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.

30 Sep 2008
7.5
CVSS
CVE-2008-4355HIGHpoc

SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

30 Sep 2008
7.5
CVSS
CVE-2008-4347HIGHpoc

SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

30 Sep 2008
7.5
CVSS
CVE-2008-3131MEDIUMpoc

SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter.

11 Jul 2008
6.8
CVSS
CVE-2008-2673HIGHpoc

SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the shownews parameter.

12 Jun 2008
7.5
CVSS
CVE-2006-6039HIGHpoc

SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the edit parameter.

22 Nov 2006
7.5
CVSS
CVE-2006-6038HIGHpoc

SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

22 Nov 2006
7.5
CVSS
CVE-2004-1716MEDIUM

Cross-site scripting (XSS) vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the (1) IRC Server or (2) AIM ID fields in the user profile.

16 Aug 2004
6.8
CVSS
CVE-2002-0319HIGHpoc

Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username.

25 Jun 2002
7.5
CVSS
CVE-2002-0287CRITICAL

pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.

31 May 2002
10.0
CVSS
← PrevPage 1 / 1Next →
← All Vendors·CVE Database