CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

CVE-2019-12830

CVE-2019-12830 affects MyBB releases before 1.8.21. A parsing flaw in the Private Message / Post renderer allows a crafted [video] BBCode to cause persistent XSS, enabling an attacker to take over a user’s forum account. The issue is described across multiple sources (NVD entry and Red Hat/CNVD v...

CVE-2019-12830: Improper Neutralization of Input During Web Page Generation

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

mybb -- vulnerabilities

mybb Team reports: High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...