CVE-2015-8977

MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files...

Cross site scripting

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login...

CVE-2016-9412

CVE-2016-9412 affects MyBB (MyBulletinBoard) prior to 1.8.7 and the MyBB Merge System prior to 1.8.7. The vulnerability stems from low adminsid and sid entropy, allowing attackers to achieve unspecified impact. Affected files/components are the core MyBB software and the Merge System integration;...

CVE-2016-9416

CVE-2016-9416 — SQL injection in the MyBB users data handler (MyBB/MyBulletinBoard) prior to 1.8.8 and Merge System prior to 1.8.8. The vulnerability allows remote attackers to execute arbitrary SQL commands via unspecified vectors due to improper handling of input in the users data handler. Affe...

CVE-2015-8977

CVE-2015-8977 affects MyBB (MyBulletinBoard) versions prior to 1.6.18 and 1.8.x prior to 1.8.6, plus the MyBB Merge System before 1.8.6. The issue allows remote attackers to disclose the installation path via vectors involving error log files, resulting in information disclosure. Root cause, as s...

CVE-2016-9419

CVE-2016-9419 affects MyBB (aka MyBulletinBoard) Admin control panel and the Merge System, with vulnerable versions before 1.8.8. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected docum...

CVE-2016-9410

CVE-2016-9410 relates to information disclosure in MyBB (MyBulletinBoard) prior to 1.8.7 and MyBB Merge System prior to 1.8.7. The issue allows remote attackers to obtain sensitive database information through vectors involving templates. This entry is supported by multiple sources (NVD/NVD-deriv...

CVE-2015-8973

xmlhttp.php in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password...

CVE-2016-9414

CVE-2016-9414 affects MyBB (MyBulletinBoard) prior to 1.8.7 and MyBB Merge System prior to 1.8.7, enabling information disclosure via missing directory listing protection in upload directories. The vulnerability is an information disclosure issue; the provided documents do not specify exploit cod...

CVE-2016-9403

The CVE-2016-9403 issue affects MyBB (MyBulletinBoard) releases prior to 1.8.7 and the MyBB Merge System prior to 1.8.7. The root cause is a missing permission check in newreply.php, allowing remote attackers to impact the system in an unspecified way. The vulnerability is described with a high/c...

CVE-2016-9420

MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."...

CVE-2016-9410

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates...

CVE-2016-9418

MyBB aka MyBulletinBoard before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name...

CVE-2016-9417

The fetchremotefile function in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery SSRF attacks via unspecified vectors...

CVE-2016-9406

CVE-2016-9406 is an XSS vulnerability in the MyBB User Control Panel (and MyBB Merge System) before version 1.8.7, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry lists impact as user-level confidentiality and integrity issues with low avail...

CVE-2016-9415

CVE-2016-9415 affects MyBB (MyBulletinBoard) on Windows prior to version 1.8.8 and MyBB Merge System on Windows prior to 1.8.8. The issue allows remote attackers to overwrite arbitrary CSS files via vectors related to “style import.” The root cause is not detailed here beyond the style import mec...

CVE-2015-8973

CVE-2015-8973 affects MyBB (MyBulletinBoard) up to before 1.6.18 and 1.8.x before 1.8.6, including MyBB Merge System before 1.8.6. The issue allows remote attackers to bypass intended access restrictions via vectors related to the forum password in xmlhttp.php, potentially enabling unauthorized a...