PT-2023-12939 · Mybb · External Redirect Warning Plugin

Name of the Vulnerable Software and Affected Versions: External Redirect Warning Plugin version 1.3 for MyBB Description: The issue concerns a problem where the redirect URL, also known as external.php?url=, is susceptible to XSS. This means an attacker could potentially inject malicious scripts...

Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen

Open source media player software provider Kodi has confirmed a data breach after threat actors stole the company's MyBB forum database containing user data and private messages. What's more, the unknown threat actors attempted to sell the data dump comprising 400,635 Kodi users on the now-defunc...

Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen

Open source media player software provider Kodi has confirmed a data breach after threat actors stole the company's MyBB forum database containing user data and private messages. What's more, the unknown threat actors attempted to sell the data dump comprising 400,635 Kodi users on the now-defunc...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Cross site scripting

UNSUPPORTED WHEN ASSIGNED The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-27890

The CVE-2023-27890 entry concerns the MyBB Export User plugin (version 2.0) exposing a cross-site scripting (XSS) vulnerability. The issue occurs during the admin DSGVO data export process, where input in Custom User Title, Location, or Bio fields can be reflected and executed. Public documentati...

MyBB 1.8.32 Remote Code Execution

Exploit Title: MyBB 1.8.32 - Chained LFI Remote Code Execution RCE Authenticated Date: 2023-01-19 Exploit Author: lUc1f3r11 https://github.com/FDlucifer Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1832 Version: MyBB 1.8.32 Tested on: Linux CVE :...

MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: MyBB 1.8.32 - Chained LFI Remote Code Execution RCE Authenticated Date: 2023-01-19 Exploit Author: lUc1f3r11 https://github.com/FDlucifer Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1832 Version: MyBB 1.8.32 Tested on: Linux CVE :...

MyBB 1.8.32 - Remote Code Execution (Authenticated) Exploit

Exploit Title: MyBB 1.8.32 - Chained LFI Remote Code Execution RCE Authenticated Exploit Author: lUc1f3r11 https://github.com/FDlucifer Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1832 Version: MyBB 1.8.32 Tested on: Linux CVE : N/A Detailed...

myBB forums 1.8.26 Cross Site Scripting

Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting XSS Exploit Author: Andrey Stoykov Software Link: https://mybb.com/versions/1.8.26/ Version: 1.8.26 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as administrator user 2. Browse to "Templates and Style...

myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)

Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting XSS Exploit Author: Andrey Stoykov Software Link: https://mybb.com/versions/1.8.26/ Version: 1.8.26 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as administrator user 2. Browse to "Templates and Style...

myBB forums 1.8.26 - Stored Cross-Site Scripting Vulnerability

Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting XSS Exploit Author: Andrey Stoykov Software Link: https://mybb.com/versions/1.8.26/ Version: 1.8.26 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as administrator user 2. Browse to "Templates and Style...

MyBB Export User 2.0 Cross Site Scripting

Exploit Title: MyBB Export User Plugin 2.0 – Cross-Site Scripting Date: January 29, 2021 Author: 0xB9 Twitter: @0xB9sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1408 Version: 2.0 Tested On: Windows 10 CVE: CVE-2023-27890 Description: This plugin allows users to request...

MyBB Active Threads 1.3.0 Cross Site Scripting

Exploit Title: MyBB Active Threads Plugin 1.3.0 – Cross-Site Scripting Date: February 9, 2022 Author: 0xB9 Twitter: @0xB9sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1336 Version: 1.3.0 Tested On: Windows 10 CVE: CVE-2022-28354 Description: This plugin shows a page of...

MyBB External Redirect Warning 1.3 Cross Site Scripting

Exploit Title: MyBB External Redirect Warning Plugin 1.3 – Cross-Site Scripting Date: February 1, 2021 Author: 0xB9 Twitter: @0xB9sec Software Link: https://community.mybb.com/mods.php?action=view&pid=493 Version: 1.3 Tested On: Windows 10 CVE: CVE-2022-28353 Description: This plugin notifies the...

MyBB <= 1.8.20 Multiple XSS Vulnerabilities

MyBB is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

MyBB < 1.8.33 Directory Traversal Vulnerability

MyBB is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...