Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

259 results · page 4 of 6

Dec 4, 2013Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to executeCVE-2013-6936 · Other software · Mybb · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
Product
Ajax Forum Stat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Nov 17, 2012SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via thCVE-2012-5909 · Other software · Mybb · reported by MITREHigh 7.5
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 17, 2012Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web scrCVE-2012-5908 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Aug 30, 2012Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."CVE-2011-5133 · Other software · Mybb · reported by MITREHigh 10
Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com secunia.com
Aug 30, 2012Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames vCVE-2011-5132 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com secunia.com
Aug 30, 2012Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests tCVE-2011-5131 · Other software · Mybb · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybb.com
Aug 13, 2012Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords paraCVE-2010-5096 · Other software · Mybb · reported by Red HatHigh 7.5
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.mybb.com openwall.com
Aug 13, 2012MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installationCVE-2012-2327 · Other software · Mybb · reported by Red HatMedium 5
MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com openwall.com
Aug 13, 2012Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to inject arbiCVE-2012-2326 · Other software · Mybb · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com openwall.com
Aug 13, 2012SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote admiCVE-2012-2325 · Other software · Mybb · reported by Red HatHigh 7.5
SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to execute arbitrary SQL commands via unspecified vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com openwall.com
Aug 13, 2012Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified CVE-2012-2324 · Other software · Mybb · reported by Red HatHigh 7.5
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP).
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com openwall.com
Nov 29, 2011SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the imCVE-2011-4569 · Other software · TOM K · reported by MITREHigh 7.5
SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter.
Product
Forum Userbar Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Sep 23, 2011MyBB (aka MyBulletinBoard) 1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path CVE-2011-3759 · Other software · Mybb · reported by MITREMedium 5
MyBB (aka MyBulletinBoard) 1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/3rdparty/diff/Diff/ThreeWay.php and certain other files.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Dec 30, 2010MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of serviCVE-2010-4629 · Other software · Mybb · reported by MITREMedium 5
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybboard.net
Dec 30, 2010member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a deniCVE-2010-4628 · Other software · Mybb · reported by MITREMedium 5
member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybboard.net
Dec 30, 2010Cross-site request forgery (CSRF) vulnerability in usercp2.php in MyBB (aka MyBulletinBoard) before 1.4.12 allows remote attackers to hijack the authentication CVE-2010-4627 · Other software · Mybb · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in usercp2.php in MyBB (aka MyBulletinBoard) before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybboard.net
Dec 30, 2010The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remoCVE-2010-4626 · Other software · Mybb · reported by MITREMedium 5.1
The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybboard.net
Dec 30, 2010MyBB (aka MyBulletinBoard) before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackeCVE-2010-4625 · Other software · Mybb · reported by MITREMedium 5
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com community.mybb.com
Dec 30, 2010MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post afteCVE-2010-4624 · Other software · Mybb · reported by MITRELow 3.5
MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com dev.mybboard.net
Dec 30, 2010Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary webCVE-2010-4522 · Other software · Mybb · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) editpost.php, (2) member.php, and (3) newreply.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybb.com openwall.com
Apr 27, 2010Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via theCVE-2009-4813 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 29, 2009Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows reCVE-2009-4449 · Other software · Mybb · reported by MITREMedium 6.5
Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybboard.net dev.mybboard.net
Dec 29, 2009inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumptioCVE-2009-4448 · Other software · Mybb · reported by MITREMedium 5
inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybboard.net dev.mybboard.net
Aug 25, 2009MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts CVE-2008-7082 · Other software · Mybb · reported by MITREMedium 6.8
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 26, 2009SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL cCVE-2009-2230 · Other software · Mybulletinboard · reported by MITREHigh 7.5
SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.mybboard.net mybboard.net
Feb 19, 2009SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via theCVE-2008-6198 · Other software · Mybboard · reported by MITREHigh 7.5
SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the page parameter.
Product
Custom Pages Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Nov 4, 2008MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackCVE-2008-4930 · Other software · Mybb · reported by MITREMedium 5
MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Nov 4, 2008MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attacCVE-2008-4929 · Other software · Mybb · reported by MITREHigh 7.5
MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Nov 4, 2008Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitraCVE-2008-4928 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a JavaScript redirect. NOTE: this can be leveraged to execute PHP code and bypass cross-site request forgery (CSRF) protection.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Sep 10, 2008moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors.CVE-2008-3967 · Other software · Mybb · reported by MITREHigh 7.5
moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Sep 10, 2008Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML viaCVE-2008-3966 · Other software · Mybb · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3) tsubject and (4) psubject fields in moderation.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Sep 10, 2008SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editoCVE-2008-3965 · Other software · Mybb · reported by MITREHigh 7.5
SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Jul 27, 2008Cross-site scripting (XSS) vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, posCVE-2008-3334 · Other software · Mybb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net secunia.com
Jul 8, 2008Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, proCVE-2008-3070 · Other software · Mybb · reported by MITREHigh 7.5
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQL injection.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Jul 8, 2008Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable.CVE-2008-3071 · Other software · Mybb · reported by MITREHigh 7.5
Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Jul 8, 2008Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameteCVE-2008-3069 · Other software · Mybb · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) portal.php and (2) inc/functions_post.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Feb 14, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or aCVE-2008-0788 · Other software · Mybb · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or administrators for requests that delete threads via a do_multideletethreads action to moderation.php and (2) hijack the authentication of arbitrary users for requests that delete private messages (PM) via a delete action to private.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net secunia.com
Feb 14, 2008SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the optionsCVE-2008-0787 · Other software · Mybulletinboard · reported by MITREMedium 6.5
SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the options[disablesmilies] parameter to private.php.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net secunia.com
Jan 22, 2008Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplayCVE-2008-0382 · Other software · Mybulletinboard · reported by MITREHigh 7.5
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jan 22, 2008Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergeCVE-2008-0383 · Other software · Mybb · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net secunia.com
May 14, 2007MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (CVE-2007-0689 · Other software · Mybb · reported by MITREMedium 5
MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info osvdb.org
Apr 24, 2007Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands CVE-2007-2212 · Other software · Mybb · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Apr 24, 2007SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the daCVE-2007-2211 · Other software · Mybulletinboard · reported by MITREHigh 7.5
SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a dayview action.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Apr 11, 2007SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execuCVE-2007-1963 · Other software · Mybb · reported by MITREHigh 7.5
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.mybboard.net community.mybboard.net
Apr 11, 2007member.php in MyBB (aka MyBulletinBoard), when debug mode is available, allows remote authenticated users to change the password of any account by providing theCVE-2007-1964 · Other software · Mybb · reported by MITREMedium 6
member.php in MyBB (aka MyBulletinBoard), when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a do_lostpw action, which prints the change password verification code in the debug output.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Apr 10, 2007Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers toCVE-2007-1906 · Other software · Ecardmax.com · reported by MITREMedium 6.8
Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the first parameter.
Product
HOT Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 31, 2007Cross-site request forgery (CSRF) vulnerability in MyBB (aka MyBulletinBoard) 1.2.2 allows remote attackers to send messages to arbitrary users.CVE-2007-0622 · Other software · Mybb · reported by MITREMedium 5
Cross-site request forgery (CSRF) vulnerability in MyBB (aka MyBulletinBoard) 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 29, 2007Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML vCVE-2007-0544 · Other software · Mybb · reported by MITREMedium 6
Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 24, 2006MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which reveals the path in an CVE-2006-4971 · Other software · Mybulletinboard · reported by MITREMedium 5
MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which reveals the path in an error message.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Sep 24, 2006Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script CVE-2006-4972 · Other software · Mybulletinboard · reported by MITREMedium 5.1
Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter.
Product
Mybulletinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.