CVE-2026-45128

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB versions prior to 1.8.40 expose a CSRF flaw in the Admin CP UTF-8 Conversion module. The do=all flow in admin/modules/tools/system_health.php performs ALTER TABLE operations and fulltext index rebuilds on GET requests without request verification, allowing same-site attackers to alter table ...

CVE-2026-45126

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45128 MyBB: ACP Users View Manager default CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

PT-2026-77181

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787

CVE-2026-72787 affects Craft CMS versions before 5.10.8. A stored XSS exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of hig...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

EUVD-2026-57447

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787: Improper Neutralization of Input During Web Page Generation

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

PT-2026-71229

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

GHSA-W36C-QXRQ-V7FW Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...