Vulnerability record · CVE-2001-1471 · published 31 July 2001

CVE-2001-1471: Phpbb vulnerability

Phpbb · Phpbb

prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.

8.8 CVSS 3.1 High EPSS 7.7% · top 5.6% CWE-665 · CWE-665

8.8CVSS 3.1 base score, v2 4.6

7.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Phpbb Phpbb

References

Link	Tags
http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.html	Broken Link
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.html	Broken Link
http://www.kb.cert.org/vuls/id/920931	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/3167	Broken LinkExploitPatchThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/6944	Third Party AdvisoryVDB Entry
http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.html	Broken Link
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.html	Broken Link
http://www.kb.cert.org/vuls/id/920931	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/3167	Broken LinkExploitPatchThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/6944	Third Party AdvisoryVDB Entry

Track CVE-2001-1471 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3224Phpbb vulnerabilityUnspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used within logi…EPSS 1.5%18 Jul 2008 10.0CVE-2008-1766Phpbb vulnerabilityMultiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."EPSS 1.5%12 Apr 2008 8.8CVE-2025-70810Phpbb cross-site request forgery vulnerabilityCross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the aut…EPSS 0.25%9 Apr 2026 8.8CVE-2019-16993Phpbb cross-site request forgery vulnerabilityIn phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Pa…EPSS 0.80%30 Sep 2019 8.1CVE-2026-29199Phpbb weak password recovery vulnerabilityphpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the ser…EPSS 0.44%4 May 2026 7.5CVE-2019-16108Phpbb code injection vulnerabilityphpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.EPSS 1.1%20 Mar 2020 7.5CVE-2019-9826Phpbb improper input validation vulnerabilityThe fulltext search component in phpBB before 3.2.6 allows Denial of Service.EPSS 2.3%2 May 2019 7.5CVE-2017-1000419Phpbb server-side request forgery (ssrf) vulnerabilityphpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal …EPSS 1.3%2 Jan 2018

Source: NIST National Vulnerability Database (record CVE-2001-1471), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.