CVE-2026-87901High 8.3Improper sanitization in the registration module allows reflected Cross-Site Scripting.0.3%
CVE-2026-48613High 7.1SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to0.2%
CVE-2026-48612High 8.0Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This 0.1%
CVE-2026-47366High 7.2Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level autho0.3%
CVE-2026-48611Critical 9.8Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.3.9%
CVE-2026-29199High 8.1phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host h0.2%