Tufat maintains a compact portfolio of web applications and productivity tools including FlashBB, MyBackup, FlashCard, and FlashChat, positioned as niche offerings in forum, backup, and communication software. The vendor's vulnerability footprint centers on application-layer input-handling and code-generation issues—code injection, path traversal, cross-site scripting, and SQL injection—that recur across its product line and reflect the web-facing nature of its offerings. These disclosures frequently acquire public exploit code, making timely patching essential for deployed instances; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tufat over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-10038CRITICAL An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and | Jul 31, 2025 | 9.3 | 46 | NO | YES |
CVE-2006-7032HIGH PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path paramete | Feb 23, 2007 | 10.0 | 37 | NO | YES |
CVE-2007-3697HIGH PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path paramet | Jul 11, 2007 | 7.5 | 34 | NO | YES |
CVE-2009-4977MEDIUM PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter. | Aug 25, 2010 | 6.5 | 30 | NO | YES |
CVE-2010-1055MEDIUM Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute a | Mar 23, 2010 | 5.1 | 30 | NO | YES |
CVE-2008-6799HIGH connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative privileges by setting the s parameter to "7." | May 7, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-4738HIGH SQL injection vulnerability in gallery.php in MyCard 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Oct 24, 2008 | 7.5 | 28 | NO | YES |
CVE-2009-4978MEDIUM Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. | Aug 25, 2010 | 5.0 | 26 | NO | YES |
CVE-2010-1872MEDIUM Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: som | May 12, 2010 | 4.3 | 22 | NO | YES |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tufat.
Media articles that mention a CVE ID that affects a product developed by Tufat — matched by CVE ID, not by vendor name.