Sir maintains a modest portfolio of web-based e-commerce and community platform products, including GnuBoard, GnuCommerce, and YoungCart5, that serve small-to-medium business and content-management use cases. The recurring vulnerability footprint centers on application-layer input-handling defects—cross-site scripting, SQL injection, open redirects, code injection, and case-sensitivity errors—that are characteristic of web frameworks where input sanitization and output encoding are critical. These weakness classes frequently acquire public exploit code, reflecting the accessibility and attractiveness of web application flaws to broad threat actors. A meaningful share of disclosed vulnerabilities reach serious severity, consistent with the server-side execution context of these platforms. Defenders should prioritize input-validation and encoding reviews in these product lines and treat patching as urgent; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sir over time
Signals from CVEs in this vendor scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-18662CRITICAL SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php. | Jun 24, 2021 | 9.8 | 42 | NO | YES |
CVE-2011-4066HIGH SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. | Nov 4, 2011 | 7.5 | 33 | NO | YES |
CVE-2014-2339MEDIUM Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) | Mar 19, 2014 | 6.5 | 32 | NO | YES |
CVE-2005-0269CRITICAL The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file | May 2, 2005 | 9.8 | 30 | NO | NO |
CVE-2022-1252CRITICAL Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryp | Apr 11, 2022 | 9.1 | 29 | NO | NO |
CVE-2024-37656MEDIUM An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php. | Jul 7, 2025 | 6.1 | 27 | NO | YES |
CVE-2009-0290MEDIUM Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path param | Jan 27, 2009 | 6.8 | 27 | NO | YES |
CVE-2004-1403HIGH PHP remote file inclusion vulnerability in index.php in GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the doc parameter to reference | Dec 31, 2004 | 7.5 | 25 | NO | NO |
CVE-2024-41475HIGH Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration. | Aug 12, 2024 | 8.8 | 24 | NO | NO |
CVE-2022-44216HIGH Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password. | Feb 20, 2023 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (42 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sir.
Media articles that mention a CVE ID that affects a product developed by Sir — matched by CVE ID, not by vendor name.