Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
259 results · page 2 of 6
Jan 3, 2023MyBB before 1.8.33 allows Directory Traversal.CVE-2022-45867 · Other software · Mybb · reported by MITREHigh 7.2
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input CVE-2022-43709 · Other software · Mybb · reported by MITREMedium 4.9
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the uCVE-2022-43708 · Other software · Mybb · reported by MITREMedium 6.1
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or storeCVE-2022-43707 · Other software · Mybb · reported by MITREMedium 6.1
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022MyBB is a free and open source forum software.CVE-2022-39265 · Other software · mybb · reported by GitHubHigh 7.2
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022MyBB is a free and open source forum software.CVE-2022-24734 · Other software · mybb · reported by GitHubHigh 7.2
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
- Product
- mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 4, 2021MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission.CVE-2021-43281 · Other software · Mybb · reported by MITREHigh 7.2
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.CVE-2021-41866 · Other software · Mybb · reported by MITREMedium 5.4
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021MyBB Cross-Poster: Stored Cross-Site ScriptingCVE-2021-39338 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- MyBB Cross-Poster
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MyBB Cross-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Aug 31, 2021Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New ForuCVE-2020-19049 · Other software · Mybb · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" pagCVE-2020-19048 · Other software · Mybb · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.CVE-2021-27949 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021SQL Injection vulnerability in MyBB before 1.8.26 via User Groups.CVE-2021-27948 · Other software · Mybb · reported by MITREHigh 7.2
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management.CVE-2021-27947 · Other software · Mybb · reported by MITREHigh 7.2
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count.CVE-2021-27946 · Other software · Mybb · reported by MITREHigh 8.8
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 15, 2021SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.CVE-2021-27890 · Other software · Mybb · reported by MITREHigh 8.8
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.sonarsource.com
Mar 15, 2021Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.CVE-2021-27889 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.sonarsource.com
Mar 9, 2021The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.CVE-2021-28115 · Other software · Ougc Feedback Project · reported by MITREMedium 6.1
The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
- Product
- Ougc Feedback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 22, 2021MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).CVE-2021-27279 · Other software · Mybb · reported by MITREMedium 5.4
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2021deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.CVE-2021-3350 · Other software · Delete Account Project · reported by MITREMedium 6.1
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
- Product
- Delete Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quoteCVE-2021-3337 · Other software · Hide Thread Content Project · reported by MITREHigh 7.5
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quote in the postbit.
- Product
- Hide Thread Content
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 10, 2020In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS CVE-2020-15139 · Other software · MyBB · reported by GitHubHigh 8.8
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.
- Product
- MyBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2020Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web scriCVE-2014-3827 · Other software · Mybb · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser action or the name parameter in an (4) edit action in the user-user module or the (5) editprofile action to modcp.php.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comadamziaja.com
Feb 11, 2020Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter iCVE-2014-3826 · Other software · Mybb · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadamziaja.comadamziaja.com
Jan 2, 2020MyBB before 1.8.22 allows an open redirect on login.CVE-2019-20225 · Other software · Mybb · reported by MITREMedium 6.1
MyBB before 1.8.22 allows an open redirect on login.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2019An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB.CVE-2019-12363 · Other software · Mybb-2fa Project · reported by MITREHigh 8.8
An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate operation lowers the security of the targeted account by disabling two factor authentication.
- Product
- Mybb-2fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.mybb.comseekurity.com
Jun 15, 2019In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database cCVE-2019-12831 · Other software · Mybb · reported by MITREHigh 7.2
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comblog.ripstech.com
Jun 15, 2019In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over anCVE-2019-12830 · Other software · Mybb · reported by MITREHigh 8.7
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comblog.ripstech.com
Jun 6, 2019MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the codCVE-2019-3579 · Other software · Mybb · reported by MITREMedium 5.3
MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comblog.mybb.com
Jun 6, 2019MyBB 1.8.19 has XSS in the resetpassword function.CVE-2019-3578 · Other software · Mybb · reported by MITREMedium 6.1
MyBB 1.8.19 has XSS in the resetpassword function.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comblog.mybb.com
Apr 11, 2019A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.CVE-2018-19202 · Other software · Mybb · reported by MITREMedium 6.1
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2019A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.CVE-2018-19201 · Other software · Mybb · reported by MITREMedium 6.1
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comgithub.com
Mar 21, 2019In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the banCVE-2018-14724 · Other software · Mybb · reported by MITREMedium 5.4
In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page.
- Product
- BAN List
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 21, 2019Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.CVE-2018-14575 · Other software · Mybb · reported by MITREHigh 8.8
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.
- Product
- Trash BIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.mybb.com
Mar 10, 2019An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.CVE-2019-9650 · Other software · Upcoming Events Project · reported by MITREMedium 6.1
An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.
- Product
- Upcoming Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.mybb.com
Jan 28, 2019An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB.CVE-2019-6979 · Other software · IP History Logs Project · reported by MITREMedium 6.1
An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.
- Product
- IP History Logs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 2, 2019The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.CVE-2019-3501 · Other software · Ougc Awards Project · reported by MITREMedium 4.8
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.
- Product
- Ougc Awards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.CVE-2018-17128 · Other software · Mybb · reported by MITREMedium 5.4
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comexploit-db.com
Aug 28, 2018An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17.CVE-2018-15596 · Other software · Mybb · reported by MITREMedium 6.1
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mybb.comexploit-db.com
Aug 24, 2018An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB.CVE-2018-11502 · Other software · Moderator LOG Notes Project · reported by MITREMedium 6.5
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF.
- Product
- Moderator LOG Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 14, 2018inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject.CVE-2018-14888 · Other software · Thank You/like Project · reported by MITREMedium 6.1
inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject.
- Product
- Thank You/like
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.mybb.com
Jul 18, 2018The New Threads plugin before 1.2 for MyBB has XSS.CVE-2018-14392 · Other software · Mybb · reported by MITREMedium 6.1
The New Threads plugin before 1.2 for MyBB has XSS.
- Product
- NEW Threads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.mybb.comexploit-db.com
Jun 26, 2018MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having tCVE-2018-1000503 · Other software · Mybb · reported by MITREMedium 4.3
MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbatterystapl.esblog.mybb.com
Jun 26, 2018MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local FCVE-2018-1000502 · Other software · Mybb · reported by MITREHigh 7.2
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbatterystapl.esblog.mybb.com
Jun 4, 2018The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.CVE-2018-11715 · Other software · Recent Threads Project · reported by MITREMedium 5.4
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
- Product
- Recent Threads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.mybb.comexploit-db.com
May 29, 2018An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB.CVE-2018-11532 · Other software · Changuondyu Advanced Statistics Project · reported by MITREMedium 6.1
An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.
- Product
- Changuondyu Advanced Statistics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 28, 2018An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB.CVE-2018-11430 · Other software · Moderator LOG Notes Project · reported by MITREMedium 5.4
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.
- Product
- Moderator LOG Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 21, 2018An issue was discovered in the Admin Notes plugin 1.1 for MyBB.CVE-2018-11092 · Other software · Admin Notes Project · reported by MITREMedium 6.5
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
- Product
- Admin Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.mybb.comgithub.com
May 13, 2018MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conductCVE-2018-10678 · Other software · Mybb · reported by MITREMedium 6.1
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgist.github.com
May 11, 2018The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts withouCVE-2018-10580 · Other software · Latest Posts ON Profile Project · reported by MITREMedium 5.4
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
- Product
- Latest Posts ON Profile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.