Filtered by vendor Mybb
Subscriptions
Filtered by product Mybb
Subscriptions
Total
123 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2007-0689 | 1 Mybb | 1 Mybb | 2018-10-16 | N/A |
| MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message. | ||||
| CVE-2007-0544 | 1 Mybb | 1 Mybb | 2018-10-16 | N/A |
| Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949. | ||||
| CVE-2008-0383 | 1 Mybb | 1 Mybb | 2018-10-15 | N/A |
| Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php. | ||||
| CVE-2018-10678 | 1 Mybb | 1 Mybb | 2018-06-05 | N/A |
| MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks. | ||||
| CVE-2018-6844 | 1 Mybb | 1 Mybb | 2018-02-26 | N/A |
| MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. | ||||
| CVE-2017-16781 | 1 Mybb | 1 Mybb | 2017-11-27 | N/A |
| The installer in MyBB before 1.8.13 has XSS. | ||||
| CVE-2012-5909 | 1 Mybb | 1 Mybb | 2017-08-29 | N/A |
| SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php. | ||||
| CVE-2012-5908 | 1 Mybb | 1 Mybb | 2017-08-29 | N/A |
| Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php. | ||||
| CVE-2011-5132 | 1 Mybb | 1 Mybb | 2017-08-29 | N/A |
| Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX." | ||||
| CVE-2011-5131 | 1 Mybb | 1 Mybb | 2017-08-29 | N/A |
| Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter. | ||||
| CVE-2011-4569 | 2 Mybb, Tom K | 2 Mybb, Forum Userbar Plugin | 2017-08-29 | N/A |
| SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter. | ||||
| CVE-2010-4629 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php. | ||||
| CVE-2010-4628 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table. | ||||
| CVE-2010-4627 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| Cross-site request forgery (CSRF) vulnerability in usercp2.php in MyBB (aka MyBulletinBoard) before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | ||||
| CVE-2010-4626 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack. | ||||
| CVE-2010-4625 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| MyBB (aka MyBulletinBoard) before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page. | ||||
| CVE-2010-4624 | 1 Mybb | 1 Mybb | 2017-08-17 | N/A |
| MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created. | ||||
| CVE-2008-3334 | 1 Mybb | 1 Mybb | 2017-08-08 | N/A |
| Cross-site scripting (XSS) vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php. | ||||
| CVE-2007-2212 | 1 Mybb | 1 Mybb | 2017-07-29 | N/A |
| Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | ||||
| CVE-2017-7566 | 1 Mybb | 1 Mybb | 2017-04-13 | N/A |
| MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. | ||||