Skip to content
Mybb vulnerabilities
Newest
-
mybb
MyBB: Contact page reflected XSS
CVE-2026-45118
9.3 Critical
-
mybb
MyBB: Installer database configuration RCE
CVE-2026-45117
9.8 Critical
-
mybb
MyBB: ACP Recovery Codes CSRF
CVE-2026-45129
4.6 Medium
-
mybb
MyBB: Mod CP report resolution missing authorization
CVE-2026-45124
4.3 Medium
-
mybb
MyBB: Insufficient authorization for private calendar events
CVE-2026-45120
5.4 Medium
-
mybb
MyBB: Buddy list corruption
CVE-2026-47245
4.3 Medium
-
mybb
MyBB: Default CAPTCHA missing invalidation
CVE-2026-45734
5.3 Medium
-
mybb
MyBB: Email User CRLF injection
CVE-2026-45125
5.3 Medium
-
mybb
MyBB: Insufficient permission check for calendar event move
CVE-2026-45122
4.3 Medium
-
mybb
MyBB: ACP UTF-8 Conversion CSRF
CVE-2026-45119
4.6 Medium
-
mybb
MyBB: ACP Questions state CSRF
CVE-2026-45126
3.5 Low
-
mybb
MyBB: Profile field type confusion XSS
CVE-2026-45116
8.7 High
-
mybb
MyBB: Buddy/ignore list username XSS
CVE-2026-45115
8.7 High
-
mybb
MyBB: Insufficient permission check for calendar select
CVE-2026-45121
4.3 Medium
-
mybb
MyBB: Security Question insufficient validation
CVE-2026-46482
5.3 Medium
-
mybb
MyBB: IPv6 SSRF
CVE-2026-45123
4.3 Medium
-
mybb
MyBB: ACP Users View Manager default CSRF
CVE-2026-45128
3.5 Low
-
mybb
MyBB: ACP Mass Mail draft resend CSRF
CVE-2026-45127
3.5 Low
-
mybb timeline plugin
MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF
CVE-2021-47934
6.9 Medium
-
mybb recent threads, dragonexpert recent threads on index +1 more
MyBB Recent threads 17.0 Persistent Cross-Site Scripting
CVE-2018-25309
5.1 Medium
-
mybb last user's threads in profile plugin, last user threads +1 more
MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS
CVE-2018-25250
5.1 Medium
-
mybb my arcade, my arcade plugin +1 more
MyBB My Arcade Plugin 1.3 Persistent XSS via Comment
CVE-2018-25249
5.1 Medium
-
mybb downloads plugin, downloads +1 more
MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php
CVE-2018-25248
5.1 Medium
-
mybb like plugin, thankyou\/like system +1 more
MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles
CVE-2018-25247
5.1 Medium
-
mybb delete account, vintagedaddyo mybb delete account plugin +1 more
MyBB Delete Account Plugin 1.4 - Cross-Site Scripting
CVE-2021-47905
5.1 Medium
-
mybb trending widget, zainali99 mybb trending widget plugin +1 more
MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
CVE-2018-25132
5.1 Medium
-
jamiesage123 mybb thread redirect plugin, mybb thread redirect +1 more
MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
CVE-2018-25116
5.1 Medium
-
mybb
MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
CVE-2023-53979
8.6 High
-
mybb, mybb forums +1 more
myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements
CVE-2023-53978
5.1 Medium
-
mybb, mybb forums +1 more
myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management
CVE-2023-53977
5.1 Medium
-
mybb, mybb forums +1 more
myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management
CVE-2023-53976
5.1 Medium
-
mybb, mybb group forum software +1 more
myBB 1.6.4 Backdoor Arbitrary Command Execution
CVE-2011-10018
Public exploit
10.0 Critical
-
mybb
MyBB may disclosure unviewable threads' titles in searches
CVE-2025-48941
5.3 Medium
-
mybb
MyBB's upgrade component vulnerable to local file inclusion
CVE-2025-48940
7.2 High
-
mybb
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add...
CVE-2025-29460
Disputed
7.6 High
-
mybb
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail...
CVE-2025-29459
Disputed
7.6 High
-
mybb
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change...
CVE-2025-29458
Disputed
7.6 High
-
mybb
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a...
CVE-2025-29457
Disputed
7.6 High
-
mybb
A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8...
CVE-2024-52702
Disputed
6.1 Medium
-
mybb
Backups directory .htaccess deletion in. MyBB
CVE-2024-23335
4.7 Medium
-
mybb
Incomplete disallowed remote addresses list in MyBB
CVE-2024-23336
5.0 Medium
-
mybb
Visual editor persistent Cross-site Scripting (XSS) in MyBB
CVE-2023-46251
Fix available
7.5 High
-
mybb
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.
CVE-2023-45556
Fix available
5.4 Medium
-
mybb
Installer RCE on settings file write in MyBB before 1.8.22.
CVE-2020-22612
Fix available
9.8 Critical
-
mybb
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling inte…
CVE-2023-41362
Public exploit
7.2 High
-
mybb
In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.
CVE-2023-28467
Public exploit
6.1 Medium
-
mybb active threads
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable...
CVE-2022-28354
6.1 Medium
-
mybb
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
CVE-2022-45867
7.2 High
-
mybb
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
CVE-2022-43709
4.9 Medium
-
mybb
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially craf…
CVE-2022-43708
6.1 Medium
- Show olderLoading…