Myupb develops a modest line of PHP-based bulletin-board and forum software that, despite limited product scope, has attracted recurring attention for input-handling and code-injection vulnerabilities. The vulnerability surface concentrates in its flagship products—Ultimate PHP Board, Flat PHP Board, and UPB—and reflects the characteristic weaknesses of web applications handling user input: cross-site scripting, SQL injection, and code injection. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Myupb over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2003-0395HIGH Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent heade | Jul 2, 2003 | 7.5 | 34 | NO | YES |
CVE-2007-6396HIGH Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, a | Dec 17, 2007 | 7.5 | 28 | NO | YES |
CVE-2007-6399MEDIUM index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading the password parameter value in the HTM | Dec 17, 2007 | 6.5 | 26 | NO | YES |
CVE-2025-61540MEDIUM SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. | Oct 16, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-61539MEDIUM Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php. | Oct 16, 2025 | 6.1 | 22 | NO | NO |
CVE-2008-6727MEDIUM Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remote attackers to inject arbitrary web script or HTML via the U | Apr 20, 2009 | 4.3 | 21 | NO | YES |
CVE-2015-2217MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q param | Mar 10, 2015 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Myupb.
Media articles that mention a CVE ID that affects a product developed by Myupb — matched by CVE ID, not by vendor name.