Advisories · Technology
mybb.
Every CVE that names mybb among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
MyBB: Contact page reflected XSS
- mybb
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
MyBB: Installer database configuration RCE
- mybb
- Code injection
- CVSS 4.6 Medium
MyBB: ACP Recovery Codes CSRF
- mybb
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
MyBB: Mod CP report resolution missing authorization
- mybb
- Broken access control
- CVSS 5.4 Medium
MyBB: Insufficient authorization for private calendar events
- mybb
- Broken access control
- CVSS 4.3 Medium
MyBB: Buddy list corruption
- mybb
- CWE-252
- CVSS 5.3 Medium
MyBB: Default CAPTCHA missing invalidation
- mybb
- CWE-837
- CVSS 5.3 Medium
MyBB: Email User CRLF injection
- mybb
- Other injection
- CVSS 4.3 Medium
MyBB: Insufficient permission check for calendar event move
- mybb
- Broken access control
- CVSS 4.6 Medium
MyBB: ACP UTF-8 Conversion CSRF
- mybb
- Cross-site request forgery (CSRF)
- CVSS 3.5 Low
MyBB: ACP Questions state CSRF
- mybb
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
MyBB: Profile field type confusion XSS
- mybb
- Cross-site scripting (XSS)
- CVSS 8.7 High
MyBB: Buddy/ignore list username XSS
- mybb
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
MyBB: Insufficient permission check for calendar select
- mybb
- Broken access control
- CVSS 5.3 Medium
MyBB: Security Question insufficient validation
- mybb
- CWE-636
- CVSS 4.3 Medium
MyBB: IPv6 SSRF
- mybb
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
MyBB: ACP Users View Manager default CSRF
- mybb
- Cross-site request forgery (CSRF)
- CVSS 3.5 Low
MyBB: ACP Mass Mail draft resend CSRF
- mybb
- Cross-site request forgery (CSRF)
- CVSS 8.6 High
MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
- MyBB
- Path traversal
- CVSS 5.3 Medium
MyBB may disclosure unviewable threads' titles in searches
- mybb
- CWE-1230
- CVSS 7.2 High
MyBB's upgrade component vulnerable to local file inclusion
- mybb
- Path traversal
- CVSS 4.7 Medium
Backups directory .htaccess deletion in. MyBB
- mybb
- CWE-20
- CVSS 5.0 Medium
Incomplete disallowed remote addresses list in MyBB
- mybb
- Server-side request forgery (SSRF)
- CWE-184
- CVSS 7.5 High
Visual editor persistent Cross-site Scripting (XSS) in MyBB
- mybb
- Cross-site scripting (XSS)
- CVSS 7.2 High
Mail settings' command parameter injection in mybb
- mybb
- Other injection
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
Remote code execution in mybb
- mybb
- Code injection
- CVSS 8.8 High
XSS in MyBB
- MyBB
- Cross-site scripting (XSS)