Mybb

Mybb

136 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5

CVE-2010-4629

  • EPSS 1.19%
  • Published 30.12.2010 21:00:02
  • Last modified 11.04.2025 00:51:21

MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated...

4.3

CVE-2009-4813

Exploit
  • EPSS 0.96%
  • Published 27.04.2010 15:30:00
  • Last modified 26.09.2025 19:39:38

Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action.

5

CVE-2009-4448

  • EPSS 1.24%
  • Published 29.12.2009 20:41:20
  • Last modified 26.09.2025 19:39:38

inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable...

6.5

CVE-2009-4449

Exploit
  • EPSS 0.5%
  • Published 29.12.2009 20:41:20
  • Last modified 26.09.2025 19:39:38

Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal seque...

6.8

CVE-2008-7082

  • EPSS 0.11%
  • Published 25.08.2009 10:30:00
  • Last modified 26.09.2025 19:39:38

MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site reques...

4.3

CVE-2008-4928

Exploit
  • EPSS 0.63%
  • Published 04.11.2008 21:00:05
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation....

7.5

CVE-2008-4929

Exploit
  • EPSS 0.73%
  • Published 04.11.2008 21:00:05
  • Last modified 09.04.2025 00:30:58

MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames.

5

CVE-2008-4930

  • EPSS 0.27%
  • Published 04.11.2008 21:00:05
  • Last modified 09.04.2025 00:30:58

MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, ...

7.5

CVE-2008-3965

  • EPSS 0.71%
  • Published 11.09.2008 01:13:47
  • Last modified 09.04.2025 00:30:58

SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.

4.3

CVE-2008-3966

Exploit
  • EPSS 0.48%
  • Published 11.09.2008 01:13:47
  • Last modified 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/function...