Mybb
Monthly
Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.
Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.
Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.
Privilege escalation in MyBB 1.8.40 lets a limited Admin Control Panel (ACP) user who holds only the delegated user-management permission promote any account into the Administrators usergroup (gid 4), gaining the full Administrator permission set. The flaw stems from the user module exposing the Administrators group as an assignable option while the datahandler's verify_usergroup() unconditionally returns true, performing no authorization check on the target group. Publicly available exploit code exists (VulnCheck), though the issue is not listed in CISA KEV and has no public evidence of active exploitation.
MyBB is a free and open source forum software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with crafted subject lines. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Like Plugin 3.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating posts or threads with unvalidated subject content. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
account deletion reason input field. Attackers can inject malicious scripts is affected by cross-site scripting (xss) (CVSS 6.1).
MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread titles with script payloads that will execute when other users view the trending widget. [CVSS 6.1 MEDIUM]
custom text input field for thread redirects. Attackers can inject malicious SVG scripts is affected by cross-site scripting (xss) (CVSS 6.1).
A remote code execution vulnerability in MyBB (CVSS 5.3) that allows attackers. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
MyBB versions prior to 1.8.39 contain a local file inclusion (LFI) vulnerability in the upgrade component due to improper input validation (CWE-22). This vulnerability allows authenticated administrators or unauthenticated attackers with access to an unlocked installer to read arbitrary files from the server filesystem. The vulnerability requires either the installer to be accessible via re-installation or the attacker to have administrative privileges, significantly limiting real-world exploitability despite the CVSS 7.2 score.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB is a free and open source forum software. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable.
MyBB is a free and open source forum software. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MyBB is a free and open source forum software. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB is a free and open source forum software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB 1.8.19 has XSS in the resetpassword function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The New Threads plugin before 1.2 for MyBB has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The installer in MyBB before 1.8.13 has XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives.". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.
Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.
Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.
Privilege escalation in MyBB 1.8.40 lets a limited Admin Control Panel (ACP) user who holds only the delegated user-management permission promote any account into the Administrators usergroup (gid 4), gaining the full Administrator permission set. The flaw stems from the user module exposing the Administrators group as an assignable option while the datahandler's verify_usergroup() unconditionally returns true, performing no authorization check on the target group. Publicly available exploit code exists (VulnCheck), though the issue is not listed in CISA KEV and has no public evidence of active exploitation.
MyBB is a free and open source forum software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with crafted subject lines. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Like Plugin 3.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating posts or threads with unvalidated subject content. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
account deletion reason input field. Attackers can inject malicious scripts is affected by cross-site scripting (xss) (CVSS 6.1).
MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread titles with script payloads that will execute when other users view the trending widget. [CVSS 6.1 MEDIUM]
custom text input field for thread redirects. Attackers can inject malicious SVG scripts is affected by cross-site scripting (xss) (CVSS 6.1).
A remote code execution vulnerability in MyBB (CVSS 5.3) that allows attackers. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
MyBB versions prior to 1.8.39 contain a local file inclusion (LFI) vulnerability in the upgrade component due to improper input validation (CWE-22). This vulnerability allows authenticated administrators or unauthenticated attackers with access to an unlocked installer to read arbitrary files from the server filesystem. The vulnerability requires either the installer to be accessible via re-installation or the attacker to have administrative privileges, significantly limiting real-world exploitability despite the CVSS 7.2 score.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB is a free and open source forum software. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable.
MyBB is a free and open source forum software. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity.
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MyBB is a free and open source forum software. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB is a free and open source forum software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB 1.8.19 has XSS in the resetpassword function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The New Threads plugin before 1.2 for MyBB has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The installer in MyBB before 1.8.13 has XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives.". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.