Mybulletinboard Security Vulnerabilities and Issues — Mybulletinboard CVE List

Lucene search

MybulletinboardMybulletinboard

43 matches found

CVE•added 2006/07/21 2:3 p.m.•58 views

CVE-2006-3761

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javascrip...

4.3CVSS5.7AI score0.00866EPSS

CVE•added 2006/03/07 10:6 p.m.•54 views

CVE-2006-1065

SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter.

5CVSS8.4AI score0.00373EPSS

CVE•added 2006/01/02 12:0 a.m.•48 views

CVE-2005-4603

Cross-site scripting (XSS) vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread.

4.3CVSS5.7AI score0.00527EPSS

CVE•added 2006/04/21 10:2 a.m.•48 views

CVE-2006-1974

SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.

7.5CVSS8.4AI score0.00453EPSS

CVE•added 2006/04/20 6:6 p.m.•47 views

CVE-2006-1912

MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL i...

5.8CVSS6.8AI score0.00898EPSS

CVE•added 2006/06/27 10:5 a.m.•47 views

CVE-2006-3243

SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter.

7.5CVSS8.8AI score0.00816EPSS

CVE•added 2006/06/13 1:2 a.m.•45 views

CVE-2006-2908

The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.

7.5CVSS7.6AI score0.0994EPSS

CVE•added 2006/03/19 11:6 a.m.•44 views

CVE-2006-1282

CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web pages.

4.3CVSS6.5AI score0.00674EPSS

CVE•added 2006/03/22 1:2 a.m.•44 views

CVE-2006-1345

polls.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to obtain sensitive information via a vote action with an "option[]=null" parameter value, which reveals the path in an error message.

5CVSS6.1AI score0.00673EPSS

CVE•added 2006/07/21 2:3 p.m.•44 views

CVE-2006-3758

inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the _SERVER[HTTP_CLIENT_IP] parameter in...

7.5CVSS7.7AI score0.00785EPSS

CVE•added 2006/04/20 6:6 p.m.•43 views

CVE-2006-1911

Cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.1 allows remote attackers to inject arbitrary web script or HTML via the attachment content disposition in an HTML attachment.

4.3CVSS5.7AI score0.00409EPSS

CVE•added 2006/09/25 1:7 a.m.•43 views

CVE-2006-4972

Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter.

5.1CVSS5.9AI score0.00841EPSS

CVE•added 2006/03/02 11:2 p.m.•42 views

CVE-2006-0959

SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.

7.5CVSS8.3AI score0.04582EPSS

CVE•added 2006/03/19 2:2 a.m.•42 views

CVE-2006-1272

Multiple cross-site scripting (XSS) vulnerabilities in member.php in MyBulletin Board (MyBB) 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) aim, (2) yahoo, (3) msn, or (4) website field.

4.3CVSS5.7AI score0.00976EPSS

CVE•added 2006/04/05 10:4 a.m.•42 views

CVE-2006-1625

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.

6.8CVSS5.5AI score0.01631EPSS

CVE•added 2006/05/25 10:2 a.m.•42 views

CVE-2006-2589

SQL injection vulnerability in rss.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter. NOTE: it is not clear from the original report how this attack can succeed, since the demonstration URL uses a variable that is overwritten w...

6.4CVSS8.2AI score0.00315EPSS

CVE•added 2006/08/01 9:4 p.m.•42 views

CVE-2006-3954

Directory traversal vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to read arbitrary files via a .. (dot dot) in the gallery parameter in a (1) avatar or (2) do_avatar action.

5CVSS7.1AI score0.0022EPSS

CVE•added 2006/02/01 2:2 a.m.•41 views

CVE-2006-0494

Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.

4.3CVSS7AI score0.00041EPSS

CVE•added 2006/07/24 12:19 p.m.•41 views

CVE-2006-3775

SQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header ($_SERVER['HTTP_CLIENT_IP'] variable), as utilized by index.php.

7.5CVSS8.2AI score0.01661EPSS

CVE•added 2006/04/11 11:2 p.m.•40 views

CVE-2006-1716

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from th...

5.1CVSS5.5AI score0.01631EPSS

CVE•added 2006/05/12 12:2 a.m.•40 views

CVE-2006-2333

Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.1 allow remote attackers to execute arbitrary SQL commands via the e-mail address when registering for a forum that requires e-mail verification, which is not properly handled in (1) usercp.php and (2) member.php.

6.4CVSS8.5AI score0.00385EPSS

CVE•added 2006/06/12 8:6 p.m.•40 views

CVE-2006-2949

Cross-site scripting (XSS) vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter.

6.8CVSS5.6AI score0.01465EPSS

CVE•added 2006/02/10 11:2 a.m.•39 views

CVE-2006-0639

Cross-site scripting (XSS) vulnerability in search.php in MyBB (aka MyBulletinBoard) 1.0.2 allows remote attackers with knowledge of the table prefix to inject arbitrary web script or HTML via a URL encoded value of the keywords parameter, as demonstrated by %3Cscript%3E.

4.3CVSS5.6AI score0.00409EPSS

CVE•added 2006/01/25 2:3 a.m.•38 views

CVE-2006-0406

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.

5CVSS6.6AI score0.00477EPSS

CVE•added 2006/01/16 9:3 p.m.•37 views

CVE-2006-0219

The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-200...

7.5CVSS7.3AI score0.00816EPSS

CVE•added 2006/07/21 2:3 p.m.•37 views

CVE-2006-3760

Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

7.5CVSS8.9AI score0.00596EPSS

CVE•added 2006/02/01 2:2 a.m.•36 views

CVE-2006-0495

Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable).

4.3CVSS5.7AI score0.00335EPSS

CVE•added 2006/03/19 11:6 a.m.•36 views

CVE-2006-1281

Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.

3.5CVSS5.6AI score0.00976EPSS

CVE•added 2006/04/11 11:2 p.m.•36 views

CVE-2006-1717

Cross-site scripting (XSS) vulnerability in newthread.php in MyBB (aka MyBulletinBoard) 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username.

5.1CVSS5.7AI score0.00874EPSS

CVE•added 2006/09/25 1:7 a.m.•35 views

CVE-2006-4971

MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which reveals the path in an error message.

5CVSS6.5AI score0.00376EPSS

CVE•added 2006/07/07 12:5 a.m.•34 views

CVE-2006-3420

Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action. NOTE: the...

7.5CVSS7.1AI score0.00717EPSS

CVE•added 2006/09/12 4:7 p.m.•34 views

CVE-2006-4707

Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).

6.8CVSS5.9AI score0.0157EPSS

CVE•added 2006/01/31 11:3 a.m.•33 views

CVE-2006-0470

Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.

4.3CVSS5.7AI score0.01248EPSS

CVE•added 2006/02/02 11:2 a.m.•33 views

CVE-2006-0523

SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.

7.5CVSS8.4AI score0.00619EPSS

CVE•added 2006/02/10 11:2 a.m.•33 views

CVE-2006-0638

SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.

6.5CVSS8AI score0.0082EPSS

CVE•added 2006/02/18 9:2 p.m.•33 views

CVE-2006-0770

Cross-site scripting (XSS) vulnerability in calendar.php in MyBulletinBoard (MyBB) 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the det...

2.6CVSS5.5AI score0.00409EPSS

CVE•added 2006/04/29 10:2 a.m.•32 views

CVE-2006-2103

SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2) setid, (3) expand, (4) ti...

2.1CVSS8AI score0.00349EPSS

CVE•added 2006/01/22 8:3 p.m.•31 views

CVE-2006-0364

Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, ...

4.3CVSS5.6AI score0.00674EPSS

CVE•added 2006/08/30 1:4 a.m.•31 views

CVE-2006-4449

Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.

5.1CVSS6AI score0.06539EPSS

CVE•added 2006/09/12 4:7 p.m.•31 views

CVE-2006-4706

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated u...

6.8CVSS5.7AI score0.0176EPSS

CVE•added 2006/05/12 12:2 a.m.•30 views

CVE-2006-2336

SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.

6.4CVSS8.4AI score0.00757EPSS

CVE•added 2006/08/01 9:4 p.m.•30 views

CVE-2006-3953

Cross-site scripting (XSS) vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.

4.3CVSS6AI score0.00323EPSS

CVE•added 2006/07/21 2:3 p.m.•27 views

CVE-2006-3759

Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."

5CVSS6.8AI score0.00437EPSS