Critical severity10.0NVD Advisory· Published Jan 31, 2017· Updated May 13, 2026
CVE-2015-8974
CVE-2015-8974
Description
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected products
8cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*range: <=1.6.17
- cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.openwall.com/lists/oss-security/2016/11/10/8nvdThird Party Advisory
- www.openwall.com/lists/oss-security/2016/11/18/1nvdMailing ListThird Party Advisory
- www.securityfocus.com/bid/94397nvdThird Party AdvisoryVDB Entry
- blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/nvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.