CVE-2004-2754: Yabb SE

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.

Affected products

• Yabb Yabb SE: version 0.8 only; version 1.1.3 only; version 1.4.1 only; version 1.5.0 only; version 1.5.1 only; version 1.5.1_rc1 only; …

Published 2004-12-31. Last modified 2026-06-16.