CVE-2003-1486: Phorum

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message.

Affected products

• Phorum Phorum: version 3.4 only; version 3.4.1 only; version 3.4.2 only

Published 2003-12-31. Last modified 2026-06-16.