CVE-2005-4199
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote...
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
- Record
CVE-2005-4199- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
- Record
CVE-2005-4199- Updated
- 2026-11-02
EUVDEUVD-2005-4194 No score
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
- Record
EUVD-2005-4194- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-whqr-8g89-8vg2 No score
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote...
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
- Record
GHSA-whqr-8g89-8vg2- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4199 is a high vulnerability (CVSS 7.5) in Mybb, published December 13, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. No source names a fixed version.
References
securityfocus.com/bid/15793
osvdb.org/22158
secunia.com/advisories/18000
trapkit.de/advisories/TKPN2005-12-001.txt
Show 11 moreShow less
securityreason.com/securityalert/246
securitytracker.com/id?1015407
community.mybboard.net/showthread.php?tid=5184&pid=30964
archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
vupen.com/english/advisories/2005/2842
nvd.nist.gov/vuln/detail/CVE-2005-4199
github.com/advisories/GHSA-whqr-8g89-8vg2