Vendor CVEs
MyBB
All CVEs
216 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-23335 | 0.00 | — | 0.01 | May 1, 2024 | MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are… | |||
| CVE-2024-23336 | 0.00 | — | 0.00 | May 1, 2024 | MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list… | |||
| CVE-2023-46251 | 0.00 | — | 0.00 | Nov 6, 2023 | MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual… | |||
| CVE-2023-45556 | 0.00 | — | 0.01 | Nov 6, 2023 | Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. | |||
| CVE-2020-22612 | 0.00 | — | 0.01 | Sep 1, 2023 | Installer RCE on settings file write in MyBB before 1.8.22. | |||
| CVE-2023-41362 | 0.00 | — | 0.02 | Aug 29, 2023 | MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. | |||
| CVE-2023-28467 | 0.00 | — | 0.01 | May 22, 2023 | In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. | |||
| CVE-2022-28354 | 0.00 | — | 0.01 | Apr 24, 2023 | In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. | |||
| CVE-2022-28353 | 0.00 | — | 0.01 | Apr 16, 2023 | In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS. | |||
| CVE-2022-45867 | 0.00 | — | 0.01 | Jan 3, 2023 | MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution. | |||
| CVE-2022-43709 | 0.00 | — | 0.01 | Nov 21, 2022 | MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. | |||
| CVE-2022-43708 | 0.00 | — | 0.00 | Nov 21, 2022 | MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name | |||
| CVE-2022-43707 | 0.00 | — | 0.00 | Nov 21, 2022 | MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data | |||
| CVE-2022-39265 | 0.00 | — | 0.02 | Oct 6, 2022 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code… | |||
| CVE-2021-43281 | 0.00 | — | 0.01 | Nov 4, 2021 | MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with… | |||
| CVE-2021-41866 | 0.00 | — | 0.00 | Oct 26, 2021 | MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. | |||
| CVE-2021-39338 | 0.00 | — | 0.01 | Oct 15, 2021 | The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject… | |||
| CVE-2020-19049 | 0.00 | — | 0.01 | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. | |||
| CVE-2020-19048 | 0.00 | — | 0.01 | Aug 31, 2021 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. | |||
| CVE-2021-27949 | 0.00 | — | 0.01 | Mar 15, 2021 | Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. | |||
| CVE-2021-27948 | 0.00 | — | 0.01 | Mar 15, 2021 | SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). | |||
| CVE-2021-27947 | 0.00 | — | 0.01 | Mar 15, 2021 | SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). | |||
| CVE-2021-27279 | 0.00 | — | 0.01 | Feb 22, 2021 | MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). | |||
| CVE-2021-3350 | 0.00 | — | 0.01 | Feb 1, 2021 | deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter. | |||
| CVE-2020-15139 | 0.00 | — | 0.01 | Aug 10, 2020 | In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as… | |||
| CVE-2014-3826 | 0.00 | — | 0.01 | Feb 11, 2020 | Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module. | |||
| CVE-2014-3827 | 0.00 | — | 0.01 | Feb 11, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser… | |||
| CVE-2019-20225 | 0.00 | — | 0.01 | Jan 2, 2020 | MyBB before 1.8.22 allows an open redirect on login. | |||
| CVE-2019-12363 | 0.00 | — | 0.01 | Jul 11, 2019 | An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate… | |||
| CVE-2019-12831 | 0.00 | — | 0.01 | Jun 15, 2019 | In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by… | |||
| CVE-2019-12830 | 0.00 | — | 0.01 | Jun 15, 2019 | In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue. | |||
| CVE-2019-3578 | 0.00 | — | 0.01 | Jun 6, 2019 | MyBB 1.8.19 has XSS in the resetpassword function. | |||
| CVE-2019-3579 | 0.00 | — | 0.02 | Jun 6, 2019 | MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter. | |||
| CVE-2018-19202 | 0.00 | — | 0.01 | Apr 11, 2019 | A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter. | |||
| CVE-2018-19201 | 0.00 | — | 0.01 | Mar 29, 2019 | A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter. | |||
| CVE-2018-14724 | 0.00 | — | 0.01 | Mar 18, 2019 | In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page. | |||
| CVE-2019-6979 | 0.00 | — | 0.02 | Jan 28, 2019 | An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field. | |||
| CVE-2018-11092 | Med | 0.00 | 6.5 | 0.01 | May 21, 2018 | An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action. | ||
| CVE-2015-4552 | 0.00 | — | 0.02 | Sep 3, 2015 | Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post. | |||
| CVE-2015-2786 | 0.00 | — | 0.01 | Mar 29, 2015 | Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders." | |||
| CVE-2015-2352 | 0.00 | — | 0.01 | Mar 19, 2015 | The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors. | |||
| CVE-2015-2335 | 0.00 | — | 0.01 | Mar 18, 2015 | A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors. | |||
| CVE-2015-2334 | 0.00 | — | 0.01 | Mar 18, 2015 | Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||
| CVE-2015-2333 | 0.00 | — | 0.01 | Mar 18, 2015 | Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2015-2332 | 0.00 | — | 0.01 | Mar 18, 2015 | Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2015-2149 | 0.00 | — | 0.02 | Mar 18, 2015 | Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module… | |||
| CVE-2014-5248 | 0.00 | — | 0.01 | Aug 14, 2014 | Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode. | |||
| CVE-2014-1840 | 0.00 | — | 0.01 | Mar 3, 2014 | Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. | |||
| CVE-2013-7288 | 0.00 | — | 0.01 | Jan 10, 2014 | Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs. | |||
| CVE-2013-7275 | 0.00 | — | 0.02 | Jan 8, 2014 | Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup. |
- CVE-2024-23335May 1, 2024risk 0.00cvss —epss 0.01
MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are…
- CVE-2024-23336May 1, 2024risk 0.00cvss —epss 0.00
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list…
- CVE-2023-46251Nov 6, 2023risk 0.00cvss —epss 0.00
MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual…
- CVE-2023-45556Nov 6, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.
- CVE-2020-22612Sep 1, 2023risk 0.00cvss —epss 0.01
Installer RCE on settings file write in MyBB before 1.8.22.
- CVE-2023-41362Aug 29, 2023risk 0.00cvss —epss 0.02
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
- CVE-2023-28467May 22, 2023risk 0.00cvss —epss 0.01
In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.
- CVE-2022-28354Apr 24, 2023risk 0.00cvss —epss 0.01
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.
- CVE-2022-28353Apr 16, 2023risk 0.00cvss —epss 0.01
In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.
- CVE-2022-45867Jan 3, 2023risk 0.00cvss —epss 0.01
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
- CVE-2022-43709Nov 21, 2022risk 0.00cvss —epss 0.01
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
- CVE-2022-43708Nov 21, 2022risk 0.00cvss —epss 0.00
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name
- CVE-2022-43707Nov 21, 2022risk 0.00cvss —epss 0.00
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data
- CVE-2022-39265Oct 6, 2022risk 0.00cvss —epss 0.02
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code…
- CVE-2021-43281Nov 4, 2021risk 0.00cvss —epss 0.01
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with…
- CVE-2021-41866Oct 26, 2021risk 0.00cvss —epss 0.00
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.
- CVE-2021-39338Oct 15, 2021risk 0.00cvss —epss 0.01
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject…
- CVE-2020-19049Aug 31, 2021risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- CVE-2020-19048Aug 31, 2021risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- CVE-2021-27949Mar 15, 2021risk 0.00cvss —epss 0.01
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
- CVE-2021-27948Mar 15, 2021risk 0.00cvss —epss 0.01
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
- CVE-2021-27947Mar 15, 2021risk 0.00cvss —epss 0.01
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
- CVE-2021-27279Feb 22, 2021risk 0.00cvss —epss 0.01
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
- CVE-2021-3350Feb 1, 2021risk 0.00cvss —epss 0.01
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
- CVE-2020-15139Aug 10, 2020risk 0.00cvss —epss 0.01
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as…
- CVE-2014-3826Feb 11, 2020risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module.
- CVE-2014-3827Feb 11, 2020risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser…
- CVE-2019-20225Jan 2, 2020risk 0.00cvss —epss 0.01
MyBB before 1.8.22 allows an open redirect on login.
- CVE-2019-12363Jul 11, 2019risk 0.00cvss —epss 0.01
An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate…
- CVE-2019-12831Jun 15, 2019risk 0.00cvss —epss 0.01
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by…
- CVE-2019-12830Jun 15, 2019risk 0.00cvss —epss 0.01
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue.
- CVE-2019-3578Jun 6, 2019risk 0.00cvss —epss 0.01
MyBB 1.8.19 has XSS in the resetpassword function.
- CVE-2019-3579Jun 6, 2019risk 0.00cvss —epss 0.02
MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter.
- CVE-2018-19202Apr 11, 2019risk 0.00cvss —epss 0.01
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
- CVE-2018-19201Mar 29, 2019risk 0.00cvss —epss 0.01
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.
- CVE-2018-14724Mar 18, 2019risk 0.00cvss —epss 0.01
In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page.
- CVE-2019-6979Jan 28, 2019risk 0.00cvss —epss 0.02
An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.
- risk 0.00cvss 6.5epss 0.01
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
- CVE-2015-4552Sep 3, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
- CVE-2015-2786Mar 29, 2015risk 0.00cvss —epss 0.01
Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
- CVE-2015-2352Mar 19, 2015risk 0.00cvss —epss 0.01
The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors.
- CVE-2015-2335Mar 18, 2015risk 0.00cvss —epss 0.01
A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.
- CVE-2015-2334Mar 18, 2015risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- CVE-2015-2333Mar 18, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2015-2332Mar 18, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2015-2149Mar 18, 2015risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module…
- CVE-2014-5248Aug 14, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode.
- CVE-2014-1840Mar 3, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
- CVE-2013-7288Jan 10, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
- CVE-2013-7275Jan 8, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup.
Page 3 of 5