2145 matches found
CVE-2020-15139
In MyBB before version 1.8.24, the custom MyCode BBCode for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as a post or Private...
Cross site scripting
In MyBB before version 1.8.24, the custom MyCode BBCode for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as a post or Private...
CVE-2020-15139 XSS in MyBB
In MyBB before version 1.8.24, the custom MyCode BBCode for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as a post or Private...
CVE-2020-15139
In MyBB (pre-1.8.24), the custom MyCode (BBCode) for the visual editor does not escape input when rendering HTML, causing a DOM-based XSS. Exploitation involves a victim visiting a page with the visual editor active (e.g., a post or Private Message) containing malicious MyCode, potentially on con...
PT-2020-14219 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.24 Description: The issue arises from improper input escaping in the custom MyCode for the visual editor, leading to a DOM-based XSS vulnerability. This can be exploited by directing a victim to a page with the visu...
FreeBSD : mybb -- multible vulnerabilities (198a120d-c22d-11ea-9172-4c72b94353b5)
mybb Team reports : High risk: Installer RCE on settings file write Medium risk: Arbitrary upload paths and Local File Inclusion RCE Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data Low risk: Open redirect on login Low risk: SCEditor reflected XSS C Tenable Network...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
CVE-2014-3826
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
Cross site scripting
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
CVE-2014-3826
CVE-2014-3826 affects MyBB prior to 1.6.13. It is a Cross-site Scripting (XSS) vulnerability exploitable by remote authenticated users via the name parameter in the edit action of the config-profile_fields module. The issue enables injection of arbitrary web script or HTML and is documented acros...
CVE-2014-3826
Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
CVE-2014-3827
CVE-2014-3827 affects MyBB versions before 1.8.4. The vulnerability is a set of stored/reflected XSS flaws that allow a remote authenticated user to inject arbitrary script/HTML via the title parameter in the user-users module (edit/add), the finduser action, or the name/parameter in the edit act...
MyBB < 1.8.22 Multiple Vulnerabilities
MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...
CVE-2019-20225
MyBB before 1.8.22 allows an open redirect on login...
CVE-2019-20225
MyBB before 1.8.22 allows an open redirect on login...
Open redirect
MyBB before 1.8.22 allows an open redirect on login...
CVE-2019-20225
CVE-2019-20225 affects MyBB up to version 1.8.21; the vulnerability is an open redirect on login, allowing an attacker to redirect users to a site of their choosing via a crafted URL. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OpenVAS, Symantec) with consistent descripti...