CVE-2022-25091

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.infopop.com/support/ubbclassic/version5.htmlBroken Link
https://marc.info/?l=vuln-dev&m=97486849231786&w=2Mailing List
https://vulners.com/securityvulns/SECURITYVULNS:DOC:954Mailing List
https://web.archive.org/web/20030207100935/Not Applicable
https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.htmlRelease Notes
http://www.infopop.com/support/ubbclassic/version5.htmlBroken Link
https://marc.info/?l=vuln-dev&m=97486849231786&w=2Mailing List
https://vulners.com/securityvulns/SECURITYVULNS:DOC:954Mailing List
https://web.archive.org/web/20030207100935/Not Applicable
https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.htmlRelease Notes

Timeline

Published: Apr 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-250948.8Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover CVE-2022-250959.8Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.CVE-2022-250969.8Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_CVE-2022-250989.1ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.CVE-2022-250997.8A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-25106.1Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTM CVE-2022-251017.8A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file CVE-2022-251047.5HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/.CVE-2022-251065.5D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attack CVE-2022-251085.5Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the point CVE-2022-25116.1Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML int CVE-2022-251146.1Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under regis