← Back

Mybb

mybb

154 CVEs • 16 products

Products (16)

Click to collapse
Toggle
Mybb
mybb
140 CVEs
Merge System
merge_system
24 CVEs
Devbb
devbb
1 CVE
Mybb Hot Editor Plugin
mybb_hot_editor_plugin
1 CVE
Ajax Forum Stat
ajax_forum_stat
1 CVE
New Threads
new_threads
1 CVE
Trash Bin
trash_bin
1 CVE
Ban List
ban_list
1 CVE
Active Threads
active_threads
1 CVE
Thread Redirect
thread_redirect
1 CVE
Trending Widget
trending_widget
1 CVE
Delete Account
delete_account
1 CVE
Mybb Downloads
mybb_downloads
1 CVE
My Arcade
my_arcade
1 CVE
Thankyou/like System
thankyou/like_system
1 CVE
Last User Threads
last_user_threads
1 CVE

CVEs (154)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-1000502
1Mybb
1Mybb
Nov 21, 2024
Jun 26, 2018
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusi...Show more
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.Show less
CVE-2018-10678
1Mybb
1Mybb
Nov 21, 2024
May 13, 2018
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks.
CVE-2018-7305
1Mybb
1Mybb
Jun 17, 2026
Feb 21, 2018
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
CVE-2018-6844
1Mybb
1Mybb
Jun 17, 2026
Feb 8, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.
CVE-2017-16781
1Mybb
1Mybb
May 13, 2026
Nov 10, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The installer in MyBB before 1.8.13 has XSS.
CVE-2017-16780
1Mybb
1Mybb
May 13, 2026
Nov 10, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.
CVE-2017-8104
1Mybb
1Mybb
May 13, 2026
Apr 24, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
CVE-2017-8103
1Mybb
1Mybb
May 13, 2026
Apr 24, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
CVE-2017-7566
1Mybb
1Mybb
May 13, 2026
Apr 6, 2017
N/A· v4
7.7 HIGH· v3
4.0 MEDIUM· v2
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
CVE-2016-9421
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web s...Show more
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2016-9420
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
CVE-2016-9419
1Mybb
1Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspeci...Show more
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2016-9418
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
CVE-2016-9417
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.4 HIGH· v3
5.8 MEDIUM· v2
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVE-2016-9416
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-9415
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
CVE-2016-9414
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
CVE-2016-9413
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2016-9412
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
CVE-2016-9411
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.