Cross site scripting

Cross-site scripting XSS vulnerability in the User control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs...

Design/Logic Flaw

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails...

Design/Logic Flaw

newreply.php in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files...

Sql injection

SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login...

Code injection

MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."...

CVE-2016-9405

CVE-2016-9405 is an XSS vulnerability in MyBB (MyBulletinBoard) related to member validation, affecting MyBB before 1.8.7 and MyBB Merge System before 1.8.7. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, with potential impact limited to client-s...

CVE-2016-9417

The CVE-2016-9417 vulnerability affects MyBB (My Bulletin Board) prior to version 1.8.8 and the MyBB Merge System prior to 1.8.8. The issue is a server-side request forgery (SSRF) via the fetch_remote_file function, enabling remote attackers to trigger requests from the vulnerable server to other...

CVE-2016-9406

Cross-site scripting XSS vulnerability in the User control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9419

CVE-2016-9419 affects MyBB (aka MyBulletinBoard) Admin control panel and the Merge System, with vulnerable versions before 1.8.8. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected docum...

CVE-2016-9408

CVE-2016-9408 is an XSS vulnerability in the MyBB Mod control panel (and MyBB Merge System) prior to 1.8.7. The issue allows remote attackers to inject arbitrary web script/HTML via vectors involving editing users. Affected software: MyBB (MyBulletinBoard) up to version 1.8.7. Root cause details ...

CVE-2016-9410

CVE-2016-9410 relates to information disclosure in MyBB (MyBulletinBoard) prior to 1.8.7 and MyBB Merge System prior to 1.8.7. The issue allows remote attackers to obtain sensitive database information through vectors involving templates. This entry is supported by multiple sources (NVD/NVD-deriv...

CVE-2015-8977

MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files...

CVE-2015-8977

CVE-2015-8977 affects MyBB (MyBulletinBoard) versions prior to 1.6.18 and 1.8.x prior to 1.8.6, plus the MyBB Merge System before 1.8.6. The issue allows remote attackers to disclose the installation path via vectors involving error log files, resulting in information disclosure. Root cause, as s...

CVE-2016-9405

Cross-site scripting XSS vulnerability in member validation in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-8973

xmlhttp.php in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password...