CVE-2015-8975

Cross-site scripting XSS vulnerability in the error handler in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9403

newreply.php in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check...

CVE-2016-9409

CV E-2016-9409 is an XSS vulnerability in the admin control panel of MyBB (and MyBB Merge System) before version 1.8.7. The flaw allows remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs. It affects MyBB prior to 1.8.7, with impact limited to client-side sc...

CVE-2016-9411

CVE-2016-9411 affects MyBB (MyBulletinBoard) Admin control panel and MyBB Merge System prior to version 1.8.7. The vulnerability allows remote attackers to disclose the installation path through vectors involving sending mails. The incident is documented in NVD with CVSS v2 base score 5.0 (Partia...

CVE-2016-9402

SQL injection vulnerability in the moderation tool in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-9420

CVE-2016-9420 affects MyBB before 1.8.8 and the MyBB Merge System before 1.8.8. The issue allows remote attackers to achieve unspecified impact via vectors related to loose comparison false positives ; exploitation is not detailed in the provided documents. The vulnerability has a CVSSv3 base sco...

CVE-2016-9421

CVE-2016-9421 describes a cross-site scripting (XSS) vulnerability in the MyBB Admin control panel, specifically in the Users module, prior to version 1.8.8 (and MyBB Merge System prior to 1.8.8). The root cause is an XSS condition that could allow remote attackers to inject arbitrary web script ...

CVE-2016-9418

CVE-2016-9418 affects MyBB (MyBulletinBoard) on Windows prior to 1.8.8 and MyBB Merge System on Windows prior to 1.8.8. The issue allows remote attackers to obtain sensitive information from ACP backups via vectors involving a short name. A fix is available in MyBB 1.8.8 release (and later); upgr...

CVE-2015-8974

The CVE affects MyBB (MyBulletinBoard) and relates to a SQL injection in the Group Promotions module of the admin control panel. Affected versions are MyBB before 1.6.18 and 1.8.x before 1.8.6; the issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Root cause...

CVE-2015-8973

CVE-2015-8973 affects MyBB (MyBulletinBoard) up to before 1.6.18 and 1.8.x before 1.8.6, including MyBB Merge System before 1.8.6. The issue allows remote attackers to bypass intended access restrictions via vectors related to the forum password in xmlhttp.php, potentially enabling unauthorized a...

CVE-2015-8976

CVE-2015-8976 describes a cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and before 1.8.6 for the 1.8.x line, including the MyBB Merge System before 1.8.6. The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to “old up...

CVE-2016-9419

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9409

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs...

CVE-2015-8975

CVE-2015-8975 affects MyBB (aka MyBulletinBoard) and the MyBB Merge System. The vulnerability is an XSS flaw in the error handler, present in MyBB before 1.6.18 and in the 1.8.x line before 1.8.6, as well as MyBB Merge System before 1.8.6. The issue allows remote attackers to inject arbitrary web...

CVE-2016-9406

CVE-2016-9406 is an XSS vulnerability in the MyBB User Control Panel (and MyBB Merge System) before version 1.8.7, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry lists impact as user-level confidentiality and integrity issues with low avail...

CVE-2016-9415

CVE-2016-9415 affects MyBB (MyBulletinBoard) on Windows prior to version 1.8.8 and MyBB Merge System on Windows prior to 1.8.8. The issue allows remote attackers to overwrite arbitrary CSS files via vectors related to “style import.” The root cause is not detailed here beyond the style import mec...

CVE-2016-9404

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login...

CVE-2016-9414

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories...

CVE-2016-9411

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails...

MyBB 1.8.3 Remote Code Execution Exploit

Exploit for php platform in category web applications GMP Deserialization Type Confusion Vulnerability MyBB - Write Date: 2015.4.28 - Release Date: 2017.1.20 A type-confusion vulnerability was discovered in GMP deserialization with crafted object's wakeup magic method that can be abused for...