CVE-2005-2836: Phorum

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.

Affected products

• Phorum Phorum: version 3.1 only; version 3.1.1 only; version 3.1.1_pre only; version 3.1.1_rc2 only; version 3.1.1a only; version 3.1.2 only; …

Published 2005-09-07. Last modified 2026-06-16.