CVE-2016-5727

LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.

• CWE-94

• http://www.openwall.com/lists/oss-security/2016/06/10/7Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/06/18/1Mailing List, Patch, Third Party Advisory
• https://github.com/SimpleMachines/SMF2.1/commit/19e560b9f3e8fc6d7d9d60c1ff617b5ed5c08008#diff-513c4f9c501cbefcc14420c01848f23cIssue Tracking, Patch, Third Party Advisory
• https://github.com/SimpleMachines/SMF2.1/issues/3522Issue Tracking, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/06/10/7Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/06/18/1Mailing List, Patch, Third Party Advisory
• https://github.com/SimpleMachines/SMF2.1/commit/19e560b9f3e8fc6d7d9d60c1ff617b5ed5c08008#diff-513c4f9c501cbefcc14420c01848f23cIssue Tracking, Patch, Third Party Advisory
• https://github.com/SimpleMachines/SMF2.1/issues/3522Issue Tracking, Patch, Third Party Advisory

Published

Feb 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5721Multiple cross-site scripting (XSS) vulnerabilities in Zimbr…
• CVE-2016-5722Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3…
• CVE-2016-5723Huawei FusionInsight HD before V100R002C60SPC200 allows loca…
• CVE-2016-5724Cloudera CDH before 5.9 has Potentially Sensitive Informatio…7.5
• CVE-2016-5725Directory traversal vulnerability in JCraft JSch before 0.1.…
• CVE-2016-5726Packages.php in Simple Machines Forum (SMF) 2.1 allows remot…
• CVE-2016-5728Race condition in the vop_ioctl function in drivers/misc/mic…
• CVE-2016-5729Lenovo BIOS EFI Driver allows local administrators to execut…8.2
• CVE-2016-5730phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, an…
• CVE-2016-5731Cross-site scripting (XSS) vulnerability in examples/openid.…
• CVE-2016-5732Multiple cross-site scripting (XSS) vulnerabilities in the p…
• CVE-2016-5733Multiple cross-site scripting (XSS) vulnerabilities in phpMy…