CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

MyBB < 1.8.36 RCE Vulnerability

MyBB is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

Code injection

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

CVE-2023-41362 affects MyBB prior to 1.8.36. The issue is a code injection in Admin CP templates that use eval; although input validation existed, PHP PCRE type juggling interferes with eval, enabling code execution by users with certain high privileges. Affected: MyBB Admin CP/template code path...

MyBB 代码注入漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use , support for multiple languages , scalable and so on. A security vulnerability exists in MyBB versions prior to 1.8.36. Attackers can exploit this vulnerability to...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

PT-2023-5287 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.36 Description: The issue is related to code injection by users with certain high privileges in the MyBB software. Templates in the Admin CP intentionally use eval, and there was some validation of the input to eval...

MyBB Favicon 1.0 Cross Site Scripting

Exploit Title: MyBB PGM Favicon Plugin 1.0 – Cross-Site Scripting Date: May 2, 2023 Author: 0xB9 Twitter: @0xB9sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1554 Version: 1.0 Tested On: Windows 10 Description: The favicon input in the settings doesn’t sanitize the favicon...

CVE-2023-28467

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

CVE-2023-28467

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

CVE-2023-28467

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

Design/Logic Flaw

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

CVE-2023-28467

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

PT-2023-21737 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.34 Description: The issue concerns a cross-site scripting XSS flaw in the User CP module, specifically via the user email field. This allows for potential malicious script execution. Recommendations: For versions...

CVE-2023-28467

In MyBB before 1.8.34, there is XSS in the User CP module via the user email field...

CVE-2023-28467

CVE-2023-28467 affects MyBB prior to 1.8.34. The vulnerability is a cross-site scripting (XSS) flaw in the User CP module that can be triggered via the user email field. Public sources consistently describe the issue as an XSS in the User Control Panel before version 1.8.34, with no additional de...