phpBB: Reflected cross-site scripting in registration
Summary
phpBB forum software contains a reflected Cross-Site Scripting (XSS) vulnerability in its registration module, caused by improper input sanitization (CWE-79). An attacker can craft a link that runs script code in the browser of a user who opens it, which can expose session data and allow actions in the victim's account. No account is needed to send the link, but the victim must interact with it. The vendor fixed the issue in 3.3.19; the 3.3.18 release did not include the announced fixes due to a packaging error.
Affected
- phpBB 3.3.0 up to and including 3.3.18
- Other branches: Unknown.
Fixed in
- phpBB 3.3.19 (vendor advisory: phpBB 3.3.19 urgent update)
- Note: 3.3.18 downloads lacked the announced security fixes due to a packaging mistake, so 3.3.18 installations must also be upgraded.
Workaround
- None documented by the vendor for 3.3.18 and earlier. Unknown.
- Upgrading to 3.3.19 or later is the only confirmed remedy.
Exploitation
- No public proof of concept found at the time of research.
- Not listed in the CISA KEV catalog (no CISA entry found for this CVE).
- No known in-the-wild exploitation.
Our recommendation
- Inventory all phpBB instances and check whether they are publicly reachable.
- Upgrade every instance to phpBB 3.3.19 or later; do not rely on the version 3.3.18 alone.
- Verify the installed version directly, for example in the Administration Control Panel, because the 3.3.18 packaging issue means the version number alone is not a complete check.
- Prioritise public-facing forums and monitor for suspicious registration activity and links to forum pages until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- phpBB 3.3.19 urgent update (vendor advisory) www.phpbb.com
- phpBB 3.3.18 release announcement www.phpbb.com
- phpBB website www.phpbb.com
- Vulners CVE record vulners.com
- VulDB CVE entry vuldb.com
- Strix CVE entry www.strix.ai
- TheHackerWire vulnerability entry www.thehackerwire.com
- MidnightBSD mports packaging PR github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:15.
Original description (NVD)
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.