Xmb Software's vulnerability footprint concentrates in web-facing community and messaging applications, particularly its forum and instant-messenger products, where the durable signal centers on input-handling and web-generation weaknesses such as cross-site scripting. These applications, while narrowly scoped in product count, tend to acquire public exploit code when vulnerabilities are disclosed, reflecting the accessibility of web application flaws to security researchers and the open-source community. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xmb Software over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-0316HIGH Cross-site scripting vulnerability in eXtreme message board (XMB) 1.6x and earlier allows remote attackers to execute script as other XMB users by inserting the script into an IMG | Jun 25, 2002 | 7.5 | 32 | NO | YES |
CVE-2006-3994HIGH SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (aka extreme message board) 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL | Aug 5, 2006 | 7.5 | 29 | NO | YES |
CVE-2006-4191MEDIUM Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory t | Aug 17, 2006 | 5.1 | 26 | NO | YES |
CVE-2004-2588MEDIUM Intentional information leak in phpinfo.php in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allows remote attackers to obtain sensitive information such as the configu | Dec 31, 2004 | 5.0 | 16 | NO | NO |
CVE-2006-0365MEDIUM Cross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an | Jan 22, 2006 | 4.3 | 14 | NO | NO |
Cross-site scripting (XSS) vulnerability in memcp.php in XMB U2U Instant Messenger allows remote authenticated users to inject arbitrary web script or HTML via the recipient field. | Jan 26, 2007 | 3.5 | 13 | NO | NO |
Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL | Apr 12, 2006 | 2.6 | 12 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xmb Software.
Media articles that mention a CVE ID that affects a product developed by Xmb Software — matched by CVE ID, not by vendor name.