CVE-2006-0364

This entry concerns CVE-2006-0364, a cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB). The issue arises when an attacker can inject arbitrary script/HTML via a signature that contains a JavaScript URI in the SRC attribute of an IMG element, where the URI uses SGML numeric charac...

CVE-2006-0364: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MyBulletinBoard MyBB allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as...

MyBB 1.0.2 Sniffing table perfix bug in search.php

--------------------Summary---------------- Software: mybb Sowtware's Web Site: http://mybboard.com Versions: 1.0.2 Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: imei Risk: low -----------------Description--------------- mybb has a security bug that...

[SA18544] MyBB "Allow HTML in Signatures" Script Insertion Security Issue

TITLE: MyBB "Allow HTML in Signatures" Script Insertion Security Issue SECUNIA ADVISORY ID: SA18544 VERIFY ADVISORY: http://secunia.com/advisories/18544/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x...

MyBB Signature HTML Code Injection

NightWarriorKurdish Hacker nightwarrior771athotmail.com MyBB Signature HTML Code Injection http://www.mybboard.com/ example: img src=&106&97&118&97&115&99&114&105&112&116&58&97&108&101&114&116&40&39&88&83&83&39&41 Contact :nightwarrior771athotmail.com NightWarriorKurdihs Hacker...

Sql injection

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...

CVE-2006-0218

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...

CVE-2006-0219

The original distribution of MyBulletinBoard MyBB to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct 1 SQL injection attacks via an attachment name that is not properly handled by inc/functionsupload.php...

CVE-2006-0218

MyBB/MyBulletinBoard has multiple concrete issues in versions before 1.0.2, including CVE-2006-0218 (related to various files and likely SQL injection), CVE-2006-0219 (SQL injection via an attachment name and related threadmode issues in usercp.php), and CVE-2006-0442 (XSS in usercp.php). The fil...

CVE-2006-0218: Undefined Security Weakness

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...

MyBB 1.0.2 SQL injection in usercp.php

this is a bug report for MyBB 1.0.2latest version bug found by imei there is a security bug in usercp.php line 830 that Allows SQL Injection and can result to full access to admin cp. bug is in result of poor checking of $mybb-input'threadmode' value against all other values in usercp.php file...

[SA18281] MyBB Multiple Vulnerabilities

TITLE: MyBB Multiple Vulnerabilities SECUNIA ADVISORY ID: SA18281 VERIFY ADVISORY: http://secunia.com/advisories/18281/ CRITICAL: Moderately critical IMPACT: Unknown, Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x...

CVE-2005-4602: Undefined Security Weakness

SQL injection vulnerability in inc/functionupload.php in MyBB before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the file extension of an uploaded file attachment...

CVE-2005-4602

CVE-2005-4602 relates to MyBB before 1.0.1, where an SQL injection vulnerability exists in inc/functions_upload.php that can be exploited via the file extension of an uploaded attachment to execute arbitrary SQL. Evidence in connected records confirms this issue and links it to later notes that M...

CVE-2005-4602

SQL injection vulnerability in inc/functionupload.php in MyBB before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the file extension of an uploaded file attachment...

CVE-2005-4603: Undefined Security Weakness

Cross-site scripting XSS vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread...

CVE-2005-4603

Cross-site scripting XSS vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread...

CVE-2005-4603

The CVE-2005-4603 entry describes a Cross-site scripting (XSS) vulnerability in printthread.php of MyBB versions 1.0.1 and earlier. The issue arises because thread messages are not properly sanitized in the print view, allowing remote attackers to inject arbitrary web script or HTML via the threa...

MyBB < 1.01 function_upload.php SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the to the file extension of an uploaded file. A remote, unauthenticated attacker can exploit this issue to manipulate SQL queries, resulting in the...

CVE-2005-4603

Cross-site scripting XSS vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread...