High severity7.2NVD Advisory· Published Nov 4, 2021· Updated Jun 17, 2026
CVE-2021-43281
CVE-2021-43281
Description
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- MyBB/MyBBdescription
Patches
Vulnerability mechanics
References
1- github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39pnvdPatchRelease NotesThird Party Advisory
News mentions
0No linked articles in our index yet.