CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

EUVD-2026-61014

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45125 MyBB: Email User CRLF injection

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45125

MyBB prior to 1.8.40 is vulnerable to mail header injection via the Email User controller. The fromname HTTP parameter (or stored username) is used unsanitized in Return-Path and Reply-To headers when mail_handler is PHP mail, enabling arbitrary header injection via CRLF sequences. CVSS 5.3 (Medi...

CVE-2026-45125

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

EUVD-2026-61011

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45125 MyBB: Email User CRLF injection

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122

In MyBB prior to 1.8.40, the do_move action in calendar.php skips checking canmoderateevents for the destination calendar, allowing a user with moderation rights on the source calendar to move events into a calendar where they only have view permission. This breaks intended access control boundar...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

EUVD-2026-61010

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB versions prior to 1.8.40 expose a CSRF flaw in the Admin CP UTF-8 Conversion module. The do=all flow in admin/modules/tools/system_health.php performs ALTER TABLE operations and fulltext index rebuilds on GET requests without request verification, allowing same-site attackers to alter table ...