CVE-2026-45116

MyBB versions prior to 1.8.40 have a type-confusion flaw in UserDataHandler::verify_profile_fields() (inc/datahandlers/user.php): when a checkbox/multiselect profile field is submitted as a non-array value, the is_array() check is skipped, bypassing specialized validation. The unchecked value is ...

CVE-2026-45116: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verifyprofilefields only performs the specialized validation when...

PT-2026-77170

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify profile fields only performs the specialized validation when is...

Sql injection

SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...

CVE-2009-2230

SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...

CVE-2009-2230: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...

CVE-2008-0787

SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the optionsdisablesmilies parameter to private.php...

CVE-2008-0787: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the optionsdisablesmilies parameter to private.php...

CVE-2007-0689: Undefined Security Weakness

MyBB 1.2.4 allows remote attackers to obtain sensitive information via the 1 action parameter to member.php, 2 imagehash parameter to captcha.php, and 3 a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message...