Ubbcentral develops UBB.threads, a web-based forum and community platform that has maintained a persistent presence in internet-connected deployments despite its relatively narrow product scope. The vendor's vulnerability profile centers on application-layer input-handling weaknesses endemic to web platforms, including SQL injection, cross-site scripting, cross-site request forgery, and related neutralization flaws that recur across the product's web interface. While the absolute volume of tracked disclosures remains modest, vulnerabilities affecting this vendor frequently acquire public exploit code, reflecting the accessibility and appeal of web application flaws to a broad range of threat actors. Defenders should treat UBB.threads instances as requiring timely patching, particularly for publicly disclosed flaws; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ubbcentral over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-6970HIGH SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter. | Aug 13, 2009 | 7.5 | 31 | NO | YES |
CVE-2006-0545HIGH SQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Num | Feb 4, 2006 | 7.5 | 31 | NO | YES |
CVE-2007-1956HIGH SQL injection vulnerability in ubbthreads.php in Groupee UBB.threads 6.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the C parameter. | Apr 11, 2007 | 7.5 | 28 | NO | YES |
CVE-2005-2058HIGH Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.ph | Jun 29, 2005 | 7.5 | 28 | NO | YES |
CVE-2004-1622HIGH SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter. | Oct 21, 2004 | 7.5 | 28 | NO | YES |
CVE-2012-5104MEDIUM Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname | Sep 23, 2012 | 4.3 | 25 | NO | YES |
CVE-2006-2568MEDIUM PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allows remote attackers to execute arbitrary PHP code via a URL | May 24, 2006 | 5.1 | 25 | NO | YES |
CVE-2006-5137MEDIUM Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doeditthem | Oct 3, 2006 | 5.1 | 23 | NO | YES |
CVE-2006-2675MEDIUM PHP remote file inclusion vulnerability in ubbt.inc.php in UBBThreads 5.x and 6.x allows remote attackers to execute arbitrary PHP code via a URL in the (1) thispath or (2) configd | May 30, 2006 | 5.1 | 23 | NO | YES |
CVE-2004-2510MEDIUM Cross-site scripting (XSS) vulnerability in showflat.php in Infopop UBB.Threads before 6.5 allows remote attackers to inject arbitrary web script or HTML via the Cat parameter. | Dec 31, 2004 | 4.3 | 22 | NO | YES |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ubbcentral.
Media articles that mention a CVE ID that affects a product developed by Ubbcentral — matched by CVE ID, not by vendor name.