Bitnami package
mybb
pkg:bitnami/mybb
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-46251 | — | < 1.8.37 | 1.8.37 | Nov 6, 2023 | MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual | ||
| CVE-2023-45556 | — | < 1.8.37 | 1.8.37 | Nov 6, 2023 | Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. | ||
| CVE-2020-22612 | — | < 1.8.22 | 1.8.22 | Sep 1, 2023 | Installer RCE on settings file write in MyBB before 1.8.22. | ||
| CVE-2022-39265 | — | < 1.8.31 | 1.8.31 | Oct 6, 2022 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Exe | ||
| CVE-2022-24734 | — | >= 1.2.0, < 1.8.30 | 1.8.30 | Mar 9, 2022 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settin | ||
| CVE-2020-19049 | — | >= 1.8.20, <= 1.8.20 | — | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. | ||
| CVE-2020-19048 | — | >= 1.8.20, <= 1.8.20 | — | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. |
- CVE-2023-46251Nov 6, 2023affected < 1.8.37fixed 1.8.37
MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual
- CVE-2023-45556Nov 6, 2023affected < 1.8.37fixed 1.8.37
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.
- CVE-2020-22612Sep 1, 2023affected < 1.8.22fixed 1.8.22
Installer RCE on settings file write in MyBB before 1.8.22.
- CVE-2022-39265Oct 6, 2022affected < 1.8.31fixed 1.8.31
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Exe
- CVE-2022-24734Mar 9, 2022affected >= 1.2.0, < 1.8.30fixed 1.8.30
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settin
- CVE-2020-19049Aug 31, 2021affected >= 1.8.20, <= 1.8.20
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- CVE-2020-19048Aug 31, 2021affected >= 1.8.20, <= 1.8.20
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.