CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115

MyBB's Buddy/Ignore component fails to escape single quotes in usernames via htmlspecialchars_uni(), enabling stored XSS in the User CP and Private Messages Select Buddies list. Victims are affected when confirming buddy removal in usercp.php or selecting buddies in the xmlhttp.php onclick handle...

CVE-2026-45115

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

EUVD-2026-61005

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

PT-2026-77169

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

EUVD-2015-4572

Malware in sbrugna...

EUVD-2008-6842

Malware in sbrugna...

CVE-2015-8973

xmlhttp.php in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password...

CVE-2015-8973: Improper Access Control

xmlhttp.php in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password...

Cross site scripting

Cross-site scripting XSS vulnerability in the quick edit function in xmlhttp.php in MyBB aka MyBulletinBoard before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post...

CVE-2015-4552

CVE-2015-4552 describes an XSS vulnerability in the MyBB (MyBulletinBoard) quick edit feature ( xmlhttp.php ) prior to version 1.8.5. The issue allows remote attackers to inject arbitrary web script or HTML via the content of a post. The NVD entry lists affected software as MyBB before 1.8.5, wit...

CVE-2015-4552: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the quick edit function in xmlhttp.php in MyBB aka MyBulletinBoard before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post...

PT-2015-6625

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.5 Description A cross-site scripting XSS issue exists in the quick edit function of xmlhttp.php, allowing remote attackers to inject arbitrary web script or HTML via the content of a post. Recommendations For version...

Crafty Syntax Live Help RFI / Path Disclosure

Exploit Title : Crafty Syntax Live Help = 2.. & 3.. RFI + Path Disclosure Date : 4/19/2013 Author : ITTIHACK Home : http://ittihack.com Vendor : http://www.craftysyntax.com Download : http://www.craftysyntax.com/craftysyntax3.4.1.zip Version : 2. and 3. , All versions Category : webapps Google do...

MyBB xmlhttp.php 'value' Parameter XSS

The version of MyBB installed on the remote host is affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to 'value' parameter of the 'xmlhttp.php' script. A remote attacker can exploit this by enticing a user to click a specially crafted URL. Note tha...

CVE-2008-6882

Live Chat comlivechat component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string...

CVE-2008-6882

Live Chat comlivechat component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string...

CVE-2008-6882: Improper Input Validation

Live Chat comlivechat component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string...