VYPR
← All advisories
High severity7.2NVD Advisory· Published Nov 4, 2021· Updated Jun 17, 2026

CVE-2021-43281

CVE-2021-43281

Description

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MyBB/Mybb3 versions
    cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*range: >=1.2.0,<1.8.29
    • (no CPE)
    • (no CPE)range: <1.8.29

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.