CVE-2026-47245

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245

In MyBB versions prior to 1.8.40, the usercp.php?action=do_editlists delete handler performs a reciprocal buddy-list update that searches for the target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. When array_search() returns false, it i...

CVE-2026-47245 MyBB: Buddy list corruption

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

EUVD-2026-61005

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115

MyBB's Buddy/Ignore component fails to escape single quotes in usernames via htmlspecialchars_uni(), enabling stored XSS in the User CP and Private Messages Select Buddies list. Victims are affected when confirming buddy removal in usercp.php or selecting buddies in the xmlhttp.php onclick handle...

CVE-2026-45115

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115: Improper Neutralization of Input During Web Page Generation

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

PT-2026-77185

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do editlists delete handler removes the selected entry from the acting user's list and then updates mybb...

CVE-2026-47245: Unchecked Return Value

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

PT-2026-77169

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

EUVD-2006-0449

Malware in sbrugna...

EUVD-2005-3325

Malware in sbrugna...

EUVD-2007-5955

Malware in sbrugna...

EUVD-2005-4194

Malware in sbrugna...

EUVD-2006-2334

Malware in sbrugna...

EUVD-2006-3947

Malware in sbrugna...

PT-2019-12765

Name of the Vulnerable Software and Affected Versions JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB Description A CSRF issue allows an attacker to forge a request to control the state of the mybb2fa plugin via "usercp.php?action=mybb2fa&do=deactivate" or...