2272 matches found
Sql injection
SQL injection vulnerability in misc.php in MyBB aka MyBulletinBoard before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via 1 a certain referrer field in usercp2.php, 2 a certain location field in inc/functionsonline.php, and certain 3 tsubject and 4 psubject fiel...
Design/Logic Flaw
moderation.php in MyBB aka MyBulletinBoard before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors...
CVE-2008-3967
The CVE-2008-3967 entry concerns MyBB (MyBulletinBoard) moderation.php prior to version 1.4.1, where moderator privilege checks are not performed correctly. The description notes unknown impact and remote attack vectors. Public references corroborate the version boundary (before 1.4.1) but do not...
CVE-2008-3966
Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via 1 a certain referrer field in usercp2.php, 2 a certain location field in inc/functionsonline.php, and certain 3 tsubject and 4 psubject fiel...
CVE-2008-3966
CVE-2008-3966 affects MyBB (MyBulletinBoard) up to version 1.4.1. It enables remote XSS via (1) a referrer field in usercp2.php, (2) a location field in inc/functions_online.php, and (3) tsubject and (4) psubject fields in moderation.php. The vulnerability allows injection of arbitrary web script...
CVE-2008-3965
MyBB (aka MyBulletinBoard) before 1.4.1 contains an SQL injection in misc.php via a certain editor field, allowing remote attackers to execute arbitrary SQL commands. The issue affects MyBB versions up to 1.4.1; upgrading to 1.4.1 or newer is the documented remediation. No exploitation details or...
CVE-2008-3965
SQL injection vulnerability in misc.php in MyBB aka MyBulletinBoard before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field...
CVE-2008-3967
moderation.php in MyBB aka MyBulletinBoard before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors...
MyBulletinBoard (MyBB) <= 1.2.11 private.php SQL Injection Exploit (2)
No description provided by source. ?php // forum mybb = 1.2.11 remote sql injection vulnerability // bug found by Janek Vind "waraxe" http://www.waraxe.us/advisory-64.html // exploit write by c411k not brutforce one symbol. insert hash in your PM in one action // // POST...
mybb1211-sql.txt
',select+username+from+mybbusers+where+uid=4,select+password+from+mybbusers+where+uid=4,select+salt+from+mybbusers+where+uid=4,adminsid',select+sid+from+mybbadminsessions+where+uid=4,'adminloginkey',select+loginkey+from+mybbadminsessions+where+uid=4,1121512515,null,null,'yes',null,null/&action=do...
MyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection (2)
',select+username+from+mybbusers+where+uid=4,select+password+from+mybbusers+where+uid=4,select+salt+from+mybbusers+where+uid=4,adminsid',select+sid+from+mybbadminsessions+where+uid=4,'adminloginkey',select+loginkey+from+mybbadminsessions+where+uid=4,1121512515,null,null,'yes',null,null/&action=do...
MyBulletinBoard (MyBB) 1.2.11 - private.php SQL Injection (2)
MyBulletinBoard MyBB 1.2.11 - private.php SQL Injection 2...
MyBB search.php文件跨站脚本执行漏洞
BUGTRAQ ID: 30401 CVECAN ID: CVE-2008-3334 MyBB是一款流行的Web论坛程序。 MyBB的search.php文件没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向论坛提交恶意请求执行脚本注入或跨站脚本攻击。 MyBB 1.2.x MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mybboard.net/download/latest...
Cross site scripting
Cross-site scripting XSS vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php...
CVE-2008-3334
Cross-site scripting XSS vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php...
CVE-2008-3334
Summary (CVE-2008-3334) : A cross‑site scripting (XSS) vulnerability exists in MyBB 1.2.x prior to 1.2.14 . The issue arises from insufficient input validation in certain parameters handled by the search path (likely including search.php), allowing remote attackers to inject arbitrary script/HTML...
CVE-2008-3334
Cross-site scripting XSS vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php...
Sql injection
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...