$ cve CVE-2005-2058 JSON

CVE-2005-2058 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 1.2% (pctl 68)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	1.23% — more likely to be exploited than 68% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-06-29
Last modified	2026-06-16

Affected (1)

Vendor	Product
ubbcentral	ubb.threads

Public exploits

Source	Title	Date
exploit-db	UBBCentral UBB.Threads < 6.5.2 Beta - 'mailthread.php' SQL Injection	2005-06-25
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'download.php?Number' SQL Injection	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'calendar.php' Multiple SQL Injections	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'modifypost.php?Number' SQL Injection	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'viewmessage.php?message' SQL Injection	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'addfav.php?main' SQL Injection	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'notifymod.php?Number' SQL Injection	2005-06-24
exploit-db	UBBCentral UBB.Threads 5.5.1/6.x - 'grabnext.php?posted' SQL Injection	2005-06-24

References

→ the Explorer · watch your stack · NVD