CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1906

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

Directory traversal

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view...

eCardMAX HotEditor 4.0 - 'Keyboard.php' Local File Inclusion

source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. HotEditor 4.0 is...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in MyBB aka MyBulletinBoard 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0622

Cross-site request forgery CSRF vulnerability in MyBB aka MyBulletinBoard 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0622

CVE-2007-0622 is a CSRF vulnerability reported in MyBB (aka MyBulletinBoard) 1.2.2 that allows remote attackers to cause a user to send messages to arbitrary recipients. The description specifies cross-site request forgery as the issue and notes the provenance comes from third‑party information; ...

CVE-2007-0622

Cross-site request forgery CSRF vulnerability in MyBB aka MyBulletinBoard 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

CVE-2007-0544

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

CVE-2007-0544

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

CVE-2007-0544

Technical details such as affected product versions, root cause, and exploitation specifics for CVE-2007-0544 are not provided in the supplied documents; monitor for updates from NVD/CVE listings.

[Aria-Security Team] MyBB Cross-Site Scripting

Aria-Security Team http://Aria-Security.com http://www.aria-security.com/forum/showthread.php?p=144 Contact: [email protected] Type:Remote Cross-Site Scripting Article on XSS: http://aria-security.net/xss.rar Discovered By Aria-Security Team Software: MyBB Explanation: First of all user...

CVE-2006-4971

MyBB aka MyBulletinBoard allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which reveals the path in an error message...

CVE-2006-4972

Cross-site scripting XSS vulnerability in archive/index.php/forum-4.html in MyBB aka MyBulletinBoard allows remote attackers to inject arbitrary web script or HTML via the navbitsname parameter...

CVE-2006-4972

CVE-2006-4972 describes a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard), specifically in the file archive/index.php/forum-4.html. The underlying issue allows remote attackers to inject arbitrary web script or HTML via the parameter navbits[][name]. The vulnerability affects t...

CVE-2006-4971

CVE-2006-4971 affects MyBB (MyBulletinBoard). A direct request to inc/plugins/hello.php allows remote attackers to trigger an error message that reveals the server path, exposing sensitive information. Impact: partial confidentiality. CVSS v2 base score: 5.0 (MEDIUM) . The supplied documents do n...

CVE-2006-4972

Cross-site scripting XSS vulnerability in archive/index.php/forum-4.html in MyBB aka MyBulletinBoard allows remote attackers to inject arbitrary web script or HTML via the navbitsname parameter...

MyBB 1.2 Full path and Cross site scripting vulnerabilities

Hello Title : MyBB 1.2 Full path and Cross site scripting vulnerabilities Discovered by : HACKERS PAL Copyrights : HACKERS PAL Website : WwW.SoQoR.NeT Email : [email protected] Full path inc/genericerror.php?message=1 inc/datahandlers/event.php inc/datahandlers/pm.php inc/datahandlers/post.php...