Comparison of Internet forum software: PHP/non-PHP (Wikipedia)
These are arranged in order by latest release date. Each one has links to a sample forum's home, thread, and register page.
Latest release 1.3RC5, March 2010.
PHP. Secunia 2009 (0 advisories). But all advisories has 1 unpatched less critical that exists up until 1.3RC4.
Latest release 5.2.15, March 2010.
PHP. Secunia 2009 (2 advisories).
Latest release 3.0.7-PL1, March 2010.
PHP. Lots of security advisories. Version 3 is better in this respect. Secunia 2009 for 2.X (38 advisories). Secunia 2009 for 3.X (4 advisories).
Latest release 3.8.5/4.0.2-PL1 March/February 2010.
PHP, proprietary. BB code, images, HTML. Secunia 2009 for 3.X (25 advisories). Secunia 2009 for 4.X (2 advisories).
Latest release 1.0-rc10, February 2010.
PHP. Secunia 2009 (0 advisories). But if you look at all advisories there's one "highly critical" unpatched from 2007.
Latest release 3.0.5, February 2010.
PHP, proprietary. $25 every six months. Version 3.X not in Secunia, but Secunia 2009 for 2.X (1 advisory).
Latest release 7.5.5, February 2010.
PHP, proprietary. Secunia 2009 (0 advisories).
Latest release 2.4.1, December 2009.
PHP. Secunia 2009 (0 advisories).
Latest release 1.4.11 December 2009.
PHP. Secunia 2009 (5 advisories).
Latest release 1.1.11, December 2009. (There are release candidates for yet-unreleased 2.0.)
PHP, freeware. A descendant of YaBB. Secunia 2009 for 1.X (4 advisories).
Latest release 3.0.0, November 2009.
PHP. Secunia 2009 for 2.X (0 advisories).
Latest relese 1.1.10, November 2009. Unfortunately this is approaching end-of-life to be replaced by yet-unreleased Vanilla 2.
PHP. Open-source, commercial. Does hosting at http://vanillaforums.com/. Secunia 2009 (1 advisory).
Latest release 1.0.10, October 2009.
PHP. Secunia 2009 (1 advisory).
Latest release 1.0.2, July 2009.
PHP. From the makers of WordPress. Secunia 2009 for 0.X (0 advisories).
Latest release 0.9.1, July 2009.
PHP. Secunia 2009 (0 advisories). But in all advisories it says there are two unpatched, one "moderately critical" from 2005.
Latest release 1.3, June 2009.
PHP. Secunia 2009 (1 advisory, unpatched, moderately critical).
Last release 1.3.4, May 2009.
PHP. Output is nice. Recent releases have been for security vulnerabilities. A fork is FluxBB. Secunia 2009 (0 advisories).
Latest release 2.4, April 2009. Version 3 is stalled since October 2009.
Perl. Secunia 2009 (0 advisories).
Latest release 1.9.11, February 2009.
PHP. Secunia 2009 (0 advisories).
Latest release 10.3.6, August 2008.
Perl. Secunia 2009 for 9.X (0 advisories).
Latest release 1.4.2, August 2008.
PHP. Secunia 2009 (0 advisories). But all advisories has 2 unpatched in 2008 and 2010, moderately critical.
This is my table of the number of security vulnerabilities in 2009 for all of the above forums.
| Software | Vulns | Release date | Comments |
| NinkoBB | 0 | 2010-03 | 1 unpatched, (fixed in 1.3RC5?) less critical |
| IceBB | 0 | 2010-02 | 1 unpatched, highly critical |
| UBB.threads | 0 | 2010-02 | |
| miniBB | 0 | 2009-12 | |
| FUDForum | 0 | 2009-11 | |
| bbPress | 0 | 2009-07 | |
| Beehive | 0 | 2009-07 | 2 unpatched, moderately critical |
| punBB | 0 | 2009-05 | |
| YaBB | 0 | 2009-04 | |
| XMB | 0 | 2009-02 | |
| E-Blah | 0 | 2008-08 | |
| Quicksilver | 0 | 2008-08 | 2 unpatched, moderately critical |
| Invision Power Board | 1 | 2010-02 | |
| Vanilla | 1 | 2009-11 | |
| UseBB | 1 | 2009-10 | |
| DeluxeBB | 1 | 2009-06 | 1 unpatched, moderately critical |
| Phorum | 2 | 2010-03 | |
| vBulletin 4.X | 2 | 2010-02 | |
| phpBB 3.X | 4 | 2010-03 | |
| Simple Machines | 4 | 2009-12 | |
| MyBB | 5 | 2009-12 | |
| vBulletin 3.X | 25 | 2010-03 | |
| phpBB 2.X | 38 | 2008-04 |
| Bulletin Board | # Vulnerabilities | |
| 1 | BBPress | 1 |
| 2 | Beehive | 1 |
| 3 | IceBB | 1 |
| 4 | QuickSilver | 1 |
| 5 | YaBB | 2 |
| 6 | PunBB | 3 |
| 7 | Phorum | 4 |
| 8 | DeluxeBB | 7 |
| 9 | PHPbb | 13 |
| 10 | MyBB | 13 |
Other options: Wordpress, Drupal, etc., individual articles with flat comments.
Consider spam resistance, moderation, quality of CAPTCHA.
Other ideas for inspiration: Google Groups, Ask E.T. forum (low-traffic, highly moderated), Hacker News.