CVE-2007-3208 json
CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests…
published 2007-06-14 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3200
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.9%
- EPSS 5.9% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code.
Patch / fix
- securityfocus.com/bid/24455 patch
- secunia.com/advisories/25656 advisory
Exploit prediction
5.86% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/24455
vdb-entry, patch
-
secunia.com
/advisories/25656
third-party-advisory, patch, vendor-advisory
-
securitytracker.com
/id?1018236
vdb-entry
- yabbforum.com /community/?board=general%3Baction=display%3Bnum=1181678785
-
osvdb.org
/37237
vdb-entry
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=538
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/34848
vdb-entry
-
osvdb.org
/37236
vdb-entry
Sources
- CVE List CVE-2007-3208
- NVD CVE-2007-3208
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.