CVE-2026-48613
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 12, 2026
- Updated
- Jun 23, 2026
- Reserved
- May 22, 2026
Description
SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated to 3.3.11 or newer yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.1 High | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L/CR:H/IR:H/AR:H | hackerone |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
phpBBphpBB |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.