CVE-2006-3953

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2006-3953

CVE-2006-3953 is a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.x, exposed via the gallery parameter of the file usercp.php. The issue allows remote attackers to inject arbitrary web script or HTML, with the vulnerability rooted in improper handling of input. The NVD lists...

CVE-2006-3954

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

CVE-2006-3953

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2006-3953: Undefined Security Weakness

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2006-3954: Undefined Security Weakness

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

MyBulletinBoard (MyBB) 1.x - usercp.php Directory Traversal

MyBulletinBoard MyBB 1.x - usercp.php Directory Traversal source: https://www.securityfocus.com/bid/19195/info MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrar...

CVE-2006-3243

SQL injection vulnerability in usercp.php in MyBB MyBulletinBoard 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter...

CVE-2006-3243

The CVE-2006-3243 issue affects MyBB (MyBulletinBoard) versions 1.0 through 1.1.3, where a SQL injection vulnerability exists in usercp.php via the showcodebuttons parameter. The underlying root cause is an injectable parameter that allows remote execution of arbitrary SQL commands. Impact detail...

CVE-2006-3243: Undefined Security Weakness

SQL injection vulnerability in usercp.php in MyBB MyBulletinBoard 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter...

MyBulletinBoard (MyBB) 1.0.x/1.1.x - 'usercp.php' SQL Injection

source: https://www.securityfocus.com/bid/18602/info MyBulletinBoard is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise t...

Sql injection

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard 1.1.1 allow remote attackers to execute arbitrary SQL commands via the e-mail address when registering for a forum that requires e-mail verification, which is not properly handled in 1 usercp.php and 2 member.php...

CVE-2006-2333

CVE-2006-2333 concerns MyBB 1.1.1 where multiple SQL injection flaws allow remote attackers to run arbitrary SQL through the email address during registration for a mail-verified forum, due to improper handling in (1) usercp.php and (2) member.php. The vulnerability permits injected SQL commands ...

CVE-2006-2333: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard 1.1.1 allow remote attackers to execute arbitrary SQL commands via the e-mail address when registering for a forum that requires e-mail verification, which is not properly handled in 1 usercp.php and 2 member.php...

CVE-2006-1288

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

Sql injection

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

CVE-2006-1288

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

CVE-2006-1288: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

CVE-2006-0442: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in usercp.php in MyBulletinBoard MyBB 1.02 allow remote attackers to inject arbitrary web script or HTML via the 1 notepad parameter in a notepad action and 2 signature parameter in an editsig action. NOTE: These are different attack vectors, and...

MyBB 1.0.1/1.0.2 Notepad - 'usercp.php' HTML Injection

source: https://www.securityfocus.com/bid/16361/info MyBB is prone to an HTML-injection vulnerability. This issue is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be executed in the contex...