First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2005-4891

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Simple Machine Forum	Simple Machine Forum	1.0.4 and earlier

References

http://www.openwall.com/lists/oss-security/2012/11/14/10Mailing List, Third Party Advisory
https://securiteam.com/exploits/5HP0N0KG0O/Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/14/10Mailing List, Third Party Advisory
https://securiteam.com/exploits/5HP0N0KG0O/Exploit, Third Party Advisory

Timeline

Published: Jan 15, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-48955.0Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memo CVE-2005-49005.9SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by atta

CVE-2005-4891: Critical severity, CVSS 9.8 | Vulnix