How many Simple Machines smf CVEs are in CISA KEV?

None of Simple Machines smf's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Simple Machines smf are affected?

78 distinct Simple Machines smf versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Simple Machines smf CVEs?

Simple Machines smf's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-99 (Improper Control of Resource Identifiers ('Resource Injection')), CWE-863 (Incorrect Authorization), CWE-918 (Server-Side Request Forgery (SSRF)).

How many critical Simple Machines smf vulnerabilities are there?

Simple Machines smf has 2 critical and 9 high-severity CVEs.

What is the average severity of Simple Machines smf CVEs?

The average CVSS base score across Simple Machines smf's scored CVEs is 6.5.

Simple Machines smf Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Simple Machines smf vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

Simple Machines smf has 24 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 10 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Simple Machines smf, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Simple Machines smf's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High9

Medium12

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Simple Machines smf's CVEs are currently listed in CISA's KEV catalog.

Public exploits

10

10 of Simple Machines smf's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Simple Machines smf version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2.1.010 CVEs
2.1-beta.18 CVEs
2.1-beta.28 CVEs
2.1-beta.38 CVEs
2.1-rc.18 CVEs
2.1-rc.28 CVEs
2.1-rc.38 CVEs
2.1-rc.48 CVEs
2.1.18 CVEs
2.1beta18 CVEs
2.1.27 CVEs
2.1.37 CVEs
2.1.47 CVEs
2.1.53 CVEs
2.1.63 CVEs
2.1.72 CVEs
3.0-alpha.12 CVEs
3.0-alpha.22 CVEs
3.0-alpha.32 CVEs
3.0-alpha.42 CVEs

Version ranges

1.1.4 <= v <= 1.1.48 CVEs
2.0 <= v <= 2.08 CVEs
1.0.12 <= v <= 1.0.127 CVEs
1.0.13 <= v <= 1.0.137 CVEs
1.0.9 <= v <= 1.0.97 CVEs
1.1 <= v <= 1.17 CVEs
1.1.5 <= v <= 1.1.57 CVEs
1.0 <= v <= 1.06 CVEs
1.0.1 <= v <= 1.0.16 CVEs
1.0.10 <= v <= 1.0.106 CVEs
1.0.14 <= v <= 1.0.146 CVEs
1.0.15 <= v <= 1.0.156 CVEs
1.0.16 <= v <= 1.0.166 CVEs
1.0.17 <= v <= 1.0.176 CVEs
1.0.18 <= v <= 1.0.186 CVEs
1.0.19 <= v <= 1.0.196 CVEs
1.0.2 <= v <= 1.0.26 CVEs
1.0.20 <= v <= 1.0.206 CVEs
1.0.21 <= v <= 1.0.216 CVEs
1.0.3 <= v <= 1.0.36 CVEs
1.0.4 <= v <= 1.0.46 CVEs
1.0.5 <= v <= 1.0.56 CVEs
1.0.6 <= v <= 1.0.66 CVEs
1.0.7 <= v <= 1.0.76 CVEs
1.0.8 <= v <= 1.0.86 CVEs
1.1.1 <= v <= 1.1.16 CVEs
1.1.10 <= v <= 1.1.106 CVEs
1.1.11 <= v <= 1.1.116 CVEs
1.1.2 <= v <= 1.1.26 CVEs
1.1.3 <= v <= 1.1.36 CVEs
1.1.6 <= v <= 1.1.66 CVEs
1.1.7 <= v <= 1.1.76 CVEs
1.1.8 <= v <= 1.1.86 CVEs
1.1.9 <= v <= 1.1.96 CVEs
<= 1.1.125 CVEs
>= 2.1.44 CVEs
>= 3.0.02 CVEs
1.0_beta5p <= v <= 1.0_beta5p2 CVEs
<= 1.1.141 CVE
1.0_beta4.1 <= v <= 1.0_beta4.11 CVE
1.0_beta4p <= v <= 1.0_beta4p1 CVE
1.1_final <= v <= 1.1_final1 CVE
1.1_rc3 <= v <= 1.1_rc31 CVE
1.1.12 <= v <= 1.1.121 CVE
1.1.13 <= v <= 1.1.131 CVE
2.0-beta2 <= v <= 2.0-beta21 CVE
2.0-beta3 <= v <= 2.0-beta31 CVE
2.0.2 <= v <= 2.0.21 CVE
2.1.0 <= v < 2.1.71 CVE
2.1.0 <= v <= 2.1.71 CVE

Fixed in

> 2.1.71 CVE
19e560b9f3e8fc6d7d9d60c1ff617b5ed5c080081 CVE
2.1.71 CVE
3.0.01 CVE
4bf35cf9e45573a5f55a6f52995086c1da89c0961 CVE
7d048f8d66aab9af51cd6ee110fbad103cf673e81 CVE
a7875e876a647572dd4c45da881b875092caac3d1 CVE
b4d23dfd74a511587c605f9d294cefc3a75b4b261 CVE

Find a version

24 CVEs

Sort

Simple Machines Forum SSRF via image proxy
CVE-2026-61520
Patch
CWE-918
Medium · CVSS 6.3
EPSS 0.3% (17th pct)2026-07-14
Simple Machines Forum Authorization Bypass via AttachmentApprove.php
CVE-2026-39903
Patch
CWE-863
High · CVSS 7.1
EPSS 0.3% (26th pct)2026-07-10
Medium vulnerability · 2025-12-18
CVE-2025-67163
Public exploit
CWE-79
Medium · CVSS 6.1
EPSS 0.2% (12th pct)2025-12-18
SimpleMachines SMF ManageNews.php cross site scripting
CVE-2025-2583
Public exploit
CWE-79
Medium · CVSS 5.1
EPSS 0.4% (30th pct)2025-03-21
SimpleMachines SMF ManageAttachments.php cross site scripting
CVE-2025-2582
Public exploit
CWE-79
Medium · CVSS 5.1
EPSS 0.4% (29th pct)2025-03-21
SimpleMachines SMF User Alert Read Status index.php resource injection
CVE-2024-7438
Public exploit
CWE-99
Medium · CVSS 5.3
EPSS 0.5% (39th pct)2024-08-03
Medium vulnerability · 2024-08-03
CVE-2024-7437
Public exploit
CWE-99
Medium · CVSS 5.3
EPSS 0.4% (36th pct)2024-08-03
High vulnerability · 2022-04-05
CVE-2022-26982
Public exploit
High · CVSS 7.2
EPSS 9.2% (95th pct)2022-04-05
High vulnerability · 2017-02-09
CVE-2016-5727
Patch
High · CVSS 8.8
EPSS 1.5% (72th pct)2017-02-09
Critical vulnerability · 2017-02-09
CVE-2016-5726
Critical · CVSS 9.8
EPSS 1.6% (73th pct)2017-02-09
Medium vulnerability · 2012-11-17
CVE-2012-5903
Public exploit
Medium · CVSS 4.3
EPSS 1.6% (74th pct)2012-11-17
Medium vulnerability · 2011-10-24
CVE-2011-4173
Medium · CVSS 6.8
EPSS 0.6% (45th pct)2011-10-24
High vulnerability · 2011-10-24
CVE-2011-3615
High · CVSS 7.5
EPSS 1.1% (63th pct)2011-10-24
Medium vulnerability · 2011-06-21
CVE-2011-1131
Medium · CVSS 5.0
EPSS 1.2% (66th pct)2011-06-21
High vulnerability · 2011-06-21
CVE-2011-1130
High · CVSS 7.5
EPSS 1.1% (62th pct)2011-06-21
Low vulnerability · 2011-06-21
CVE-2011-1129
Low · CVSS 3.5
EPSS 1.0% (59th pct)2011-06-21
High vulnerability · 2011-06-21
CVE-2011-1128
High · CVSS 7.5
EPSS 1.6% (73th pct)2011-06-21
Critical vulnerability · 2011-06-21
CVE-2011-1127
Critical · CVSS 10.0
EPSS 2.2% (81th pct)2011-06-21
High vulnerability · 2009-08-13
CVE-2008-6971
Public exploit
High · CVSS 7.5
EPSS 7.1% (94th pct)2009-08-13
High vulnerability · 2009-07-08
CVE-2009-2385
Public exploit
High · CVSS 7.5
EPSS 1.0% (58th pct)2009-07-08
High vulnerability · 2008-04-30
CVE-2008-2019
High · CVSS 7.5
EPSS 4.1% (90th pct)2008-04-30
Medium vulnerability · 2006-12-07
CVE-2006-6375
Medium · CVSS 6.8
EPSS 1.4% (70th pct)2006-12-07
Medium vulnerability · 2006-09-06
CVE-2006-4564
Medium · CVSS 5.1
EPSS 1.0% (61th pct)2006-09-06
Medium vulnerability · 2005-05-10
CVE-2004-1996
Public exploit
Medium · CVSS 4.3
EPSS 1.7% (75th pct)2005-05-10

Common weakness types

The CWE weakness categories most often found in Simple Machines smf CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Simple Machines smf CVEs were published each year.

2005

1

2006

2

2008

1

2009

2

2011

7

2012

1

2017

2

2022

1

2024

2

2025

3

2026

2

Other Simple Machines products

Browse vulnerabilities for other products by Simple Machines.

simple machines forum41 CVEs simple machine forum3 CVEs simple machines smf2 CVEs opencart1 CVEs phpraider1 CVEs SMF2.11 CVEs smf shoutbox1 CVEs

All Simple Machines vulnerabilities

Frequently asked questions

Common questions about Simple Machines smf vulnerabilities.

How many CVEs does Simple Machines smf have?: Simple Machines smf has 24 published CVE records since 2005.
How many Simple Machines smf CVEs are in CISA KEV?: None of Simple Machines smf's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Simple Machines smf vulnerabilities?: Yes — 10 of Simple Machines smf's CVEs have a known public exploit.
Which versions of Simple Machines smf are affected?: 78 distinct Simple Machines smf versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Simple Machines smf CVEs?: Simple Machines smf's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-99 (Improper Control of Resource Identifiers ('Resource Injection')), CWE-863 (Incorrect Authorization), CWE-918 (Server-Side Request Forgery (SSRF)).
How many critical Simple Machines smf vulnerabilities are there?: Simple Machines smf has 2 critical and 9 high-severity CVEs.
What is the average severity of Simple Machines smf CVEs?: The average CVSS base score across Simple Machines smf's scored CVEs is 6.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.