How many CVEs does phpBB have?

phpBB has 165 published CVE records since 2002, including 7 in the last two years.

How many phpBB CVEs are in CISA KEV?

None of phpBB's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which phpBB products have the most CVEs?

The phpBB products with the most published CVEs are phpBB, phpbb-auction, phpbb advanced guestbook, phpbb plus, phpBB3.

What are the most common weakness types in phpBB CVEs?

phpBB's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-287 (Improper Authentication), CWE-284 (Improper Access Control), CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).

Are there public exploits for phpBB vulnerabilities?

Yes — 64 of phpBB's CVEs have a known public exploit.

How many critical phpBB vulnerabilities are there?

phpBB has 13 critical and 58 high-severity CVEs.

What is the average severity of phpBB CVEs?

The average CVSS base score across phpBB's scored CVEs is 6.5.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

165 CVEs

phpBB Vulnerabilities

Name: phpBB vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for phpBB.

165

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

64

Public exploits

PoC or exploit code

6.5

Avg CVSS

2002–2026

Overview

phpBB has 165 published CVE records since 2002, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 64 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting phpBB products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on phpBB's vulnerability posture, as a share of its 165 published CVEs.

Average CVSS: 6.5
Critical / high: 43%
Actively exploited (KEV): 0%
Public exploit available: 39%
Patch available: 13%

Severity and exploitation

How the CVSS severity of phpBB's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical13

High58

Medium92

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of phpBB's CVEs are currently listed in CISA's KEV catalog.

Public exploits

64

64 of phpBB's CVEs have a known public exploit available.

Most affected products

The phpBB products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in phpBB CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish phpBB CVE records.

Disclosure activity by year

How many phpBB CVEs were published each year.

2010

2

2015

2

2017

1

2018

2

2019

5

2020

5

2023

1

2026

7

Latest phpBB CVEs

The most recently disclosed vulnerabilities affecting phpBB.

High vulnerability · 2026-06-12
CWE-89
High · CVSS 7.1
EPSS 0.2%2026-06-12
High vulnerability · 2026-06-12
CWE-352
High · CVSS 8.0
EPSS 0.1%2026-06-12
High vulnerability · 2026-06-12
CWE-284
High · CVSS 7.2
EPSS 0.3%2026-06-12
Critical vulnerability · 2026-06-12
CWE-287
Critical · CVSS 9.8
EPSS 2.9%2026-06-12
High vulnerability · 2026-05-04
CWE-640
High · CVSS 8.1
EPSS 0.2%2026-05-04
Medium vulnerability · 2026-04-09
CWE-352
Medium · CVSS 4.3
EPSS 0.1%2026-04-09
High vulnerability · 2026-04-09
CWE-352
High · CVSS 8.8
EPSS 0.2%2026-04-09
phpBB Smiley Pack acp_icons.php main cross site scripting
CWE-79
Medium · CVSS 6.1
EPSS 0.5%2023-11-02
Medium vulnerability · 2020-08-17
CWE-610
Medium · CVSS 5.8
EPSS 1.0%2020-08-17
High vulnerability · 2020-03-19
High · CVSS 7.5
EPSS 1.1%2020-03-19
Medium vulnerability · 2020-03-11
Medium · CVSS 4.3
EPSS 0.4%2020-03-11
Medium vulnerability · 2020-01-14
Medium · CVSS 6.5
EPSS 0.4%2020-01-14

Track new phpBB CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor phpBB CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

MongoDB168 CVEs BEA Systems168 CVEs Nokia167 CVEs openatom166 CVEs pimcore165 CVEs djangoproject164 CVEs Concrete CMS163 CVEs Rapid7162 CVEs

Browse all vendors

Frequently asked questions

Common questions about phpBB vulnerabilities.

How many CVEs does phpBB have?: phpBB has 165 published CVE records since 2002, including 7 in the last two years.
How many phpBB CVEs are in CISA KEV?: None of phpBB's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which phpBB products have the most CVEs?: The phpBB products with the most published CVEs are phpBB, phpbb-auction, phpbb advanced guestbook, phpbb plus, phpBB3.
What are the most common weakness types in phpBB CVEs?: phpBB's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-287 (Improper Authentication), CWE-284 (Improper Access Control), CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
Are there public exploits for phpBB vulnerabilities?: Yes — 64 of phpBB's CVEs have a known public exploit.
How many critical phpBB vulnerabilities are there?: phpBB has 13 critical and 58 high-severity CVEs.
What is the average severity of phpBB CVEs?: The average CVSS base score across phpBB's scored CVEs is 6.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track phpBB vulnerabilities

Monitor new phpBB vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing