Zorum
Vendor:
First CVE: Dec 31, 2002 · Active for 23 years
12
Total CVEs
More Total CVEs than 90% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
5.7
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Zorum over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2002
23 years ago
Most Recent CVE
Oct 20, 2006
7,217 days ago
CVE Severity & Scoring
Zorum12 CVEs
8%
50%
42%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown12 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown12 (100.0%)
User Interaction
None0 (0.0%)
Unknown12 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown12 (100.0%)
Top CVEs
Signals from CVEs in this product scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2005-2651HIGH gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter. | Aug 23, 2005 | 7.5 | 30 | NO | YES |
CVE-2006-5431HIGH PHP remote file inclusion vulnerability in gorum/dbproperty.php in PHPOutsourcing Zorum 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appDi | Oct 20, 2006 | 7.5 | 28 | NO | YES |
CVE-2005-4619HIGH SQL injection vulnerability in index.php in phpoutsourcing Zorum Forum 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the rollid parameter in the sho | Dec 31, 2005 | 7.5 | 28 | NO | YES |
CVE-2003-1089MEDIUM index.php for Zorum 3.4 allows remote attackers to determine the full path of the web root via invalid parameter names, which reveals the path in a PHP error message. | Dec 31, 2003 | 5.0 | 23 | NO | YES |
CVE-2003-1088MEDIUM Cross-site scripting (XSS) vulnerability in index.php for Zorum 3.4 and 3.5 allows remote attackers to inject arbitrary web script or HTML via the method parameter. | Aug 11, 2003 | 4.3 | 21 | NO | YES |
CVE-2006-3332HIGH SQL injection vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to execute arbitrary SQL commands via the (1) offset, (2) tid, (3) fromid, (4) sortby, (5) fromf | Jun 30, 2006 | 7.5 | 19 | NO | NO |
CVE-2005-0676HIGH index.php in Zorum 3.5 allows remote attackers to trigger an SQL error, and possibly inject arbitrary SQL commands, via the search capability. | May 4, 2005 | 7.5 | 19 | NO | NO |
CVE-2005-2652MEDIUM Zorum 3.5 allows remote attackers to obtain the full installation path via direct requests to (1) gorum/notification.php, (2) user.php, (3) attach.php, (4) blacklist.php, (5) zorum | Aug 23, 2005 | 5.0 | 15 | NO | NO |
CVE-2005-0677MEDIUM index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter. | May 2, 2005 | 5.0 | 15 | NO | NO |
CVE-2005-0675MEDIUM Cross-site scripting (XSS) vulnerability in index.php for Zorum 3.5 allows remote attackers to inject arbitrary web script or HTML via the (1) list or (2) frommethod parameters. | May 2, 2005 | 4.3 | 14 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (12 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
5 CVEs
41.7% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (12 CVEs).
Media Mentions
Signals from CVEs in this product scope (12 CVEs).
Top CNAs Publishing CVEs For Zorum
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.5 | 9 | 5.7 | 1.7% | 0 | 3 |
| 3.4 | 5 | 5.7 | 1.6% | 0 | 3 |
| 3.3 | 4 | 5.9 | 1.3% | 0 | 2 |
| 3.2 | 3 | 6.4 | 1.4% | 0 | 2 |
| 3.1 | 3 | 6.4 | 1.4% | 0 | 2 |
| 3.0 | 3 | 6.4 | 1.4% | 0 | 2 |
| 2.4 | 1 | 4.3 | 0.9% | 0 | 0 |