Mybb

Mybb

136 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2011-10018

Exploit
  • EPSS 47.45%
  • Published 13.08.2025 20:35:31
  • Last modified 14.08.2025 17:42:18

myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was ...

5.3

CVE-2025-48941

  • EPSS 0.06%
  • Published 02.06.2025 15:58:49
  • Last modified 02.07.2025 15:14:30

MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing sp...

7.2

CVE-2025-48940

  • EPSS 0.09%
  • Published 02.06.2025 15:52:36
  • Last modified 02.07.2025 15:18:47

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to explo...

7.6

CVE-2025-29457

Exploit
  • EPSS 0.18%
  • Published 17.04.2025 00:00:00
  • Last modified 24.04.2025 14:13:52

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

7.6

CVE-2025-29458

Exploit
  • EPSS 0.18%
  • Published 17.04.2025 00:00:00
  • Last modified 24.04.2025 14:14:21

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

7.6

CVE-2025-29459

Exploit
  • EPSS 0.18%
  • Published 17.04.2025 00:00:00
  • Last modified 27.06.2025 15:45:56

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

7.6

CVE-2025-29460

  • EPSS 0.14%
  • Published 17.04.2025 00:00:00
  • Last modified 25.04.2025 16:27:20

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

5.4

CVE-2024-52702

Exploit
  • EPSS 0.22%
  • Published 20.11.2024 21:15:08
  • Last modified 07.07.2025 18:07:18

A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter.

4.7

CVE-2024-23335

  • EPSS 0.2%
  • Published 01.05.2024 07:15:38
  • Last modified 30.06.2025 15:03:32

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolve...

5

CVE-2024-23336

  • EPSS 0.11%
  • Published 01.05.2024 07:15:38
  • Last modified 30.06.2025 15:10:32

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote A...