CVE-2015-3880

Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.

• CWE-601

• http://www.openwall.com/lists/oss-security/2015/05/12/10Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/74592Third Party Advisory, VDB Entry
• https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04Patch, Third Party Advisory
• https://wiki.phpbb.com/Release_Highlights/3.0.14Third Party Advisory
• https://wiki.phpbb.com/Release_Highlights/3.1.4Third Party Advisory
• https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/05/12/10Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/74592Third Party Advisory, VDB Entry
• https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04Patch, Third Party Advisory
• https://wiki.phpbb.com/Release_Highlights/3.0.14Third Party Advisory
• https://wiki.phpbb.com/Release_Highlights/3.1.4Third Party Advisory
• https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941Vendor Advisory

Published

Sep 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3874The Sonivox components in Android before 5.1.1 LMY48T allow …
• CVE-2015-3875libutils in Android before 5.1.1 LMY48T allows remote attack…
• CVE-2015-3876libstagefright in Android through 5.1.1 LMY48M allows remote…
• CVE-2015-3877Skia, as used in Android before 5.1.1 LMY48T, allows remote …
• CVE-2015-3878Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 …
• CVE-2015-3879Media Player Framework in Android before 5.1.1 LMY48T allows…
• CVE-2015-3881Information disclosure issue in qdPM 8.3 allows remote attac…
• CVE-2015-3882qdPM 8.3 allows remote attackers to obtain sensitive informa…
• CVE-2015-3883Multiple cross-site scripting (XSS) vulnerabilities in qdPM …
• CVE-2015-3884Unrestricted file upload vulnerability in the (1) myAccount,…8.8
• CVE-2015-3885Integer overflow in the ljpeg_start function in dcraw 7.00 a…
• CVE-2015-3886libinfinity before 0.6.6-1 does not validate expired SSL cer…