CVE-2018-25248

🗓️ 04 Apr 2026 13:51:13Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

CVE-2018-25248: MyBB Downloads Plugin 2.0.3 persistent XSS via the download title field.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2018-25248	4 Apr 202613:51	–	attackerkb
Circl	CVE-2018-25248	11 Apr 202604:07	–	circl
CNNVD	MyBB（MyBulletinBoard）跨站脚本漏洞	4 Apr 202600:00	–	cnnvd
Cvelist	CVE-2018-25248 MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	4 Apr 202613:51	–	cvelist
EUVD	EUVD-2018-21748	4 Apr 202615:30	–	euvd
NVD	CVE-2018-25248	4 Apr 202614:16	–	nvd
Positive Technologies	PT-2026-30368	4 Apr 202600:00	–	ptsecurity
Vulnrichment	CVE-2018-25248 MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	4 Apr 202613:51	–	vulnrichment

NVD

Vulners

CNA

Node

mybb mybb_downloadsMatch2.0.3mybb

[
  {
    "vendor": "MyBB",
    "product": "MyBB Downloads Plugin",
    "versions": [
      {
        "version": "2.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/mybb-downloads-plugin-persistent-xss-via-downloads-php
exploit-db	www.exploit-db.com/exploits/44400
community	www.community.mybb.com/mods.php

Parameter	Position	Path	Description	CWE
title	request body	downloads.php	Persistent cross-site scripting vulnerability in MyBB Downloads Plugin 2.0.3 via the download title field; scripts execute when an administrator validates the download in downloads.php.	CWE-79

17 Jun 2026 01:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.1

CVSS 3.17.2

EPSS0.00225

SSVC

CWE-79