Skip to contentMybb vulnerabilities
Newest
- mybbMyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored dataCVE-2022-437076.1 Medium
- mybbMail settings' command parameter injection in mybbCVE-2022-39265Fix available7.2 High
- mybbRemote code execution in mybbCVE-2022-24734Public exploitFix availableEPSS 77.8%7.2 High
- mybbMyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion…CVE-2021-432817.2 High
- mybbMyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.CVE-2021-418665.4 Medium
- mybbCross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script...CVE-2020-190495.4 Medium
- mybbCross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script...CVE-2020-190485.4 Medium
- mybbCross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.CVE-2021-279496.1 Medium
- mybbSQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).CVE-2021-279487.2 High
- mybbSQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).CVE-2021-279477.2 High
- mybbSQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).CVE-2021-27946Public exploit8.8 High
- mybbSQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.CVE-2021-27890Public exploitEPSS 10.7%8.8 High
- mybbCross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.CVE-2021-27889Public exploit6.1 Medium
- mybbMyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).CVE-2021-272795.4 Medium
- mybbXSS in MyBBCVE-2020-151398.8 High
- mybbCross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users...CVE-2014-38265.4 Medium
- mybbMultiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8...CVE-2014-38275.4 Medium
- mybbMyBB before 1.8.22 allows an open redirect on login.CVE-2019-202256.1 Medium
- mybbIn MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that...CVE-2019-128317.2 High
- mybbIn MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post...CVE-2019-128308.7 High
- mybbMyBB 1.8.19 has XSS in the resetpassword function.CVE-2019-35786.1 Medium
- mybbMyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the...CVE-2019-35795.3 Medium
- mybbA reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers...CVE-2018-192026.1 Medium
- mybbA reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote...CVE-2018-192016.1 Medium
- mybb ban listIn the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input...CVE-2018-147245.4 Medium
- mybb trash binTrash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross...CVE-2018-14575Public exploit8.8 High
- mybbA Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.CVE-2018-17128Public exploitEPSS 74.8%5.4 Medium
- mybbAn issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS...CVE-2018-15596Public exploit6.1 Medium
- mybb new threadsThe New Threads plugin before 1.2 for MyBB has XSS.CVE-2018-14392Public exploitEPSS 48.6%6.1 Medium
- mybbMyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can...CVE-2018-10005034.3 Medium
- mybbMyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance ->...CVE-2018-10005027.2 High
- mybbMyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A...CVE-2018-106786.1 Medium
- mybbMyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.CVE-2018-73054.9 Medium
- mybbMyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.CVE-2018-68445.4 Medium
- mybbThe installer in MyBB before 1.8.13 has XSS.CVE-2017-16781Public exploit5.4 Medium
- mybbThe installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing...CVE-2017-16780Public exploit9.8 Critical
- mybbIn MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.CVE-2017-81045.3 Medium
- mybbIn MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover...CVE-2017-81036.1 Medium
- mybbMyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.CVE-2017-75667.7 High
- mybb merge system, mybb +1 moreCross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB ...CVE-2016-94216.1 Medium
- mybb merge system, mybb +1 moreMyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers...CVE-2016-94209.8 Critical
- mybbCross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard)...CVE-2016-94196.1 Medium
- mybb merge system, mybb +1 moreMyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows...CVE-2016-94187.5 High
- mybb merge system, mybb +1 moreThe fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System...CVE-2016-94177.4 High
- mybb merge system, mybb +1 moreSQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8...CVE-2016-94169.8 Critical
- mybb merge system, mybb +1 moreMyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows...CVE-2016-94157.5 High
- mybb merge system, mybb +1 moreMyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers...CVE-2016-94147.5 High
- mybb merge system, mybb +1 moreThe Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1...CVE-2016-94136.5 Medium
- mybb merge system, mybb +1 moreMyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to...CVE-2016-94129.8 Critical
- mybb merge system, mybb +1 moreThe Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1...CVE-2016-94115.3 Medium
- Show moreLoading…