Mybb
by MyBB
Source repositories
CVEs (180)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-45867 | 0.00 | — | 0.01 | Jan 3, 2023 | MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution. | |||
| CVE-2022-43708 | 0.00 | — | 0.00 | Nov 21, 2022 | MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name | |||
| CVE-2022-43709 | 0.00 | — | 0.01 | Nov 21, 2022 | MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. | |||
| CVE-2022-43707 | 0.00 | — | 0.00 | Nov 21, 2022 | MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data | |||
| CVE-2022-39265 | 0.00 | — | 0.02 | Oct 6, 2022 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code… | |||
| CVE-2021-43281 | 0.00 | — | 0.01 | Nov 4, 2021 | MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with… | |||
| CVE-2021-41866 | 0.00 | — | 0.00 | Oct 26, 2021 | MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. | |||
| CVE-2020-19049 | 0.00 | — | 0.01 | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. | |||
| CVE-2020-19048 | 0.00 | — | 0.01 | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. | |||
| CVE-2021-27949 | 0.00 | — | 0.01 | Mar 15, 2021 | Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. | |||
| CVE-2021-27948 | 0.00 | — | 0.01 | Mar 15, 2021 | SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). | |||
| CVE-2021-27947 | 0.00 | — | 0.01 | Mar 15, 2021 | SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). | |||
| CVE-2021-27279 | 0.00 | — | 0.01 | Feb 22, 2021 | MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). | |||
| CVE-2020-15139 | 0.00 | — | 0.01 | Aug 10, 2020 | In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as… | |||
| CVE-2014-3826 | 0.00 | — | 0.01 | Feb 11, 2020 | Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module. | |||
| CVE-2014-3827 | 0.00 | — | 0.01 | Feb 11, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser… | |||
| CVE-2019-20225 | 0.00 | — | 0.01 | Jan 2, 2020 | MyBB before 1.8.22 allows an open redirect on login. | |||
| CVE-2019-12831 | 0.00 | — | 0.01 | Jun 15, 2019 | In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by… | |||
| CVE-2019-12830 | 0.00 | — | 0.01 | Jun 15, 2019 | In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue. | |||
| CVE-2019-3578 | 0.00 | — | 0.01 | Jun 6, 2019 | MyBB 1.8.19 has XSS in the resetpassword function. |
- CVE-2022-45867Jan 3, 2023risk 0.00cvss —epss 0.01
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
- CVE-2022-43708Nov 21, 2022risk 0.00cvss —epss 0.00
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name
- CVE-2022-43709Nov 21, 2022risk 0.00cvss —epss 0.01
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
- CVE-2022-43707Nov 21, 2022risk 0.00cvss —epss 0.00
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data
- CVE-2022-39265Oct 6, 2022risk 0.00cvss —epss 0.02
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code…
- CVE-2021-43281Nov 4, 2021risk 0.00cvss —epss 0.01
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with…
- CVE-2021-41866Oct 26, 2021risk 0.00cvss —epss 0.00
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.
- CVE-2020-19049Aug 31, 2021risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- CVE-2020-19048Aug 31, 2021risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- CVE-2021-27949Mar 15, 2021risk 0.00cvss —epss 0.01
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
- CVE-2021-27948Mar 15, 2021risk 0.00cvss —epss 0.01
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
- CVE-2021-27947Mar 15, 2021risk 0.00cvss —epss 0.01
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
- CVE-2021-27279Feb 22, 2021risk 0.00cvss —epss 0.01
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
- CVE-2020-15139Aug 10, 2020risk 0.00cvss —epss 0.01
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as…
- CVE-2014-3826Feb 11, 2020risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module.
- CVE-2014-3827Feb 11, 2020risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser…
- CVE-2019-20225Jan 2, 2020risk 0.00cvss —epss 0.01
MyBB before 1.8.22 allows an open redirect on login.
- CVE-2019-12831Jun 15, 2019risk 0.00cvss —epss 0.01
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by…
- CVE-2019-12830Jun 15, 2019risk 0.00cvss —epss 0.01
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue.
- CVE-2019-3578Jun 6, 2019risk 0.00cvss —epss 0.01
MyBB 1.8.19 has XSS in the resetpassword function.
Page 5 of 9