CVE-2026-25923

< 20260208.1

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1

9.1CRITICAL

CVE-2019-12253

< 2.4.20

my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting.

6.5MEDIUM

CVE-2018-15569

all versions

my little forum 2.4.12 allows CSRF for deletion of users.

6.5MEDIUM

CVE-2018-14937

all versions

The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.

4.8MEDIUM

CVE-2018-14936

all versions

The Add page option in my little forum 2.4.12 allows XSS via the Title field.

4.8MEDIUM

CVE-2015-1435

<= 2.3.3

Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or

CVE-2015-1434

<= 2.3.3

Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL comman

CVE-2015-1475

all versions

Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitr

CVE-2010-2133

all versions

SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id

CVE-2008-4871

all versions

Cross-site scripting (XSS) vulnerability in My Little Forum 1.75 and 2.0 Beta 23 allows remote attackers to inject arbitrary web s

CVE-2007-2942

<= 1.7

SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary SQL comman

CVE-2007-2103

all versions

Multiple PHP remote file inclusion vulnerabilities in my little forum 1.7 allow remote attackers to execute arbitrary PHP code via

CVE-2006-0471

all versions

Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last mo

CVE-2005-3045

all versions

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL com