CVE-2013-7236

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-29 · updated 2026-06-17
Weakness: CWE-20

Description

Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.

Affected products

SimpleMachines Simple Machines Forum: through 1.1.9; 1.0, 1.0-beta4, 1.0-beta4.1, 1.0-beta5, 1.0-beta6, 1.0-rc1 (+48)

References

http://seclists.org/fulldisclosure/2013/Dec/83
http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/
http://www.openwall.com/lists/oss-security/2013/12/30/1
http://www.openwall.com/lists/oss-security/2013/12/30/3
http://seclists.org/fulldisclosure/2013/Dec/83
http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/
http://www.openwall.com/lists/oss-security/2013/12/30/1
http://www.openwall.com/lists/oss-security/2013/12/30/3

Get alerted when CVE-2013-7236 or the next vulnerability affects your stack