Unrated severityNVD Advisory· Published Nov 4, 2021· Updated Aug 4, 2024
CVE-2021-43281
CVE-2021-43281
Description
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- MyBB/MyBBdescription
Patches
Vulnerability mechanics
References
1- github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39pmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.