CVE-2012-4036

Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2012-1216.

• http://osvdb.org/84479
• http://secunia.com/advisories/50153Vendor Advisory
• http://www.pbboard.com/forums/t10352.htmlVendor Advisory, URL Repurposed
• http://www.pbboard.com/forums/t10353.htmlExploit, URL Repurposed
• http://www.securityfocus.com/bid/54916Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77508
• https://www.htbridge.com/advisory/HTB23101
• http://osvdb.org/84479
• http://secunia.com/advisories/50153Vendor Advisory
• http://www.pbboard.com/forums/t10352.htmlVendor Advisory, URL Repurposed
• http://www.pbboard.com/forums/t10353.htmlExploit, URL Repurposed
• http://www.securityfocus.com/bid/54916Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77508
• https://www.htbridge.com/advisory/HTB23101

Published

Aug 27, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4030Chamilo before 1.8.8.6 does not adequately handle user suppl…7.5
• CVE-2012-4031Multiple directory traversal vulnerabilities in src/acloglog…
• CVE-2012-4032Open redirect vulnerability in the login page in WebsitePane…
• CVE-2012-4033Multiple unspecified vulnerabilities in the Zingiri Web Shop…
• CVE-2012-4034Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allo…
• CVE-2012-4035The new_password page in PBBoard 2.1.4 allows remote attacke…
• CVE-2012-4037Multiple cross-site scripting (XSS) vulnerabilities in the w…
• CVE-2012-4043Cross-site scripting (XSS) vulnerability in global-protect/l…
• CVE-2012-4045Multiple heap-based buffer overflows in bmp.w5s in Winamp be…
• CVE-2012-4046The D-Link DCS-932L camera with firmware 1.02 allows remote …
• CVE-2012-4048The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x be…
• CVE-2012-4049epan/dissectors/packet-nfs.c in the NFS dissector in Wiresha…