Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

259 results · page 3 of 6

May 1, 2018An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB.CVE-2018-10365 · Other software · Threads TO Link Project · reported by MITREMedium 5.4
An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized.
Product
Threads TO Link
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 21, 2018MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.CVE-2018-7305 · Other software · Mybb · reported by MITREMedium 4.9
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record websecnerd.blogspot.in websecnerd.blogspot.in
Feb 8, 2018MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.CVE-2018-6844 · Other software · Mybb · reported by MITREMedium 5.4
MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record websecnerd.blogspot.com websecnerd.blogspot.com
Nov 10, 2017The installer in MyBB before 1.8.13 has XSS.CVE-2017-16781 · Other software · Mybb · reported by MITREMedium 5.4
The installer in MyBB before 1.8.13 has XSS.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com exploit-db.com
Nov 10, 2017The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.CVE-2017-16780 · Other software · Mybb · reported by MITRECritical 9.8
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com exploit-db.com
Sep 21, 2017SQL Injection vulnerability in mobiquo/lib/classTTForum.php in the Tapatalk plugin before 4.5.8 for MyBB allows an unauthenticated remote attacker to inject arbCVE-2017-14652 · Other software · Tapatalk · reported by MITRECritical 9.8
SQL Injection vulnerability in mobiquo/lib/classTTForum.php in the Tapatalk plugin before 4.5.8 for MyBB allows an unauthenticated remote attacker to inject arbitrary SQL commands via an XML-RPC encoded document sent as part of the user registration process.
Product
Tapatalk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adrianhayter.com tapatalk.com
Apr 24, 2017In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.CVE-2017-8104 · Other software · Mybb · reported by MITREMedium 5.3
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Apr 24, 2017In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.CVE-2017-8103 · Other software · Mybb · reported by MITREMedium 6.1
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org blog.mybb.com
Apr 6, 2017MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.CVE-2017-7566 · Other software · Mybb · reported by MITREHigh 7.7
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com blog.mybb.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before CVE-2016-9421 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose compaCVE-2016-9420 · Other software · Mybb · reported by MITRECritical 9.8
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote CVE-2016-9419 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information frCVE-2016-9418 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side requCVE-2016-9417 · Other software · Mybb · reported by MITREHigh 7.4
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to eCVE-2016-9416 · Other software · Mybb · reported by MITRECritical 9.8
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vecCVE-2016-9415 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directorCVE-2016-9414 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks viCVE-2016-9413 · Other software · Mybb · reported by MITREMedium 6.5
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and siCVE-2016-9412 · Other software · Mybb · reported by MITRECritical 9.8
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path viCVE-2016-9411 · Other software · Mybb · reported by MITREMedium 5.3
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors invCVE-2016-9410 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow reCVE-2016-9409 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remoCVE-2016-9408 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arCVE-2016-9407 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remCVE-2016-9406 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote aCVE-2016-9405 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arCVE-2016-9404 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a miCVE-2016-9403 · Other software · Mybb · reported by MITRECritical 9.8
newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers toCVE-2016-9402 · Other software · Mybb · reported by MITRECritical 9.8
SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via veCVE-2015-8977 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remotCVE-2015-8976 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.CVE-2015-8975 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBCVE-2015-8974 · Other software · Mybb · reported by MITRECritical 10
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 31, 2017xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended accCVE-2015-8973 · Other software · Mybb · reported by MITREHigh 8.3
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Sep 3, 2015Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject CVE-2015-4552 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adrianhayter.com blog.mybb.com
Mar 29, 2015Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong groupCVE-2015-2786 · Other software · Mybb · reported by MITREHigh 10
Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 19, 2015The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers toCVE-2015-2352 · Other software · Mybb · reported by MITREHigh 7.5
The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 18, 2015A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.CVE-2015-2335 · Other software · Mybb · reported by MITREMedium 5
A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 18, 2015Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijCVE-2015-2334 · Other software · Mybb · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 18, 2015Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script CVE-2015-2333 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 18, 2015Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTMLCVE-2015-2332 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com securityfocus.com
Mar 18, 2015Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users toCVE-2015-2149 · Other software · Mybb · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com seclists.org
Dec 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTCVE-2014-9241 · Other software · Mybb · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php, (2) signature parameter in a do_editsig action to usercp.php, or (3) title parameter in the style-templates module in an edit_template action or (4) file parameter in the config-languages module in an edit action to admin/index.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com packetstormsecurity.com
Dec 3, 2014SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the queCVE-2014-9240 · Other software · Mybb · reported by MITREHigh 7.5
SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com packetstormsecurity.com
Aug 14, 2014Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCodCVE-2014-5248 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com secunia.com
Apr 8, 2014SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allows remote attackers to execute arbitrary CVE-2011-5278 · Other software · Advanced Forum Signatures Project · reported by MITREHigh 7.5
SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allows remote attackers to execute arbitrary SQL commands via the afs_bar_right parameter.
Product
Advanced Forum Signatures
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 8, 2014Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4 for MyBB allow remote attackers to execCVE-2011-5277 · Other software · Advanced Forum Signatures Project · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4 for MyBB allow remote attackers to execute arbitrary SQL commands via the (1) afs_type, (2) afs_background, (3) afs_showonline, (4) afs_bar_left, (5) afs_bar_center, (6) afs_full_line1, (7) afs_full_line2, (8) afs_full_line3, (9) afs_full_line4, (10) afs_full_line5, or (11) afs_full_line6 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Advanced Forum Signatures
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 3, 2014Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the CVE-2014-1840 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osandamalith.wordpress.com packetstormsecurity.com
Jan 10, 2014Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote atCVE-2013-7288 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com osvdb.org
Jan 8, 2014Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML CVE-2013-7275 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.