← Back

Mybb

mybb

154 CVEs • 16 products

Products (16)

Click to collapse
Toggle
Mybb
mybb
140 CVEs
Merge System
merge_system
24 CVEs
Devbb
devbb
1 CVE
Mybb Hot Editor Plugin
mybb_hot_editor_plugin
1 CVE
Ajax Forum Stat
ajax_forum_stat
1 CVE
New Threads
new_threads
1 CVE
Trash Bin
trash_bin
1 CVE
Ban List
ban_list
1 CVE
Active Threads
active_threads
1 CVE
Thread Redirect
thread_redirect
1 CVE
Trending Widget
trending_widget
1 CVE
Delete Account
delete_account
1 CVE
Mybb Downloads
mybb_downloads
1 CVE
My Arcade
my_arcade
1 CVE
Thankyou/like System
thankyou/like_system
1 CVE
Last User Threads
last_user_threads
1 CVE

CVEs (154)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-9410
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
CVE-2016-9409
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via ve...Show more
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.Show less
CVE-2016-9408
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vect...Show more
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.Show less
CVE-2016-9407
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control...Show more
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.Show less
CVE-2016-9406
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via uns...Show more
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2016-9405
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecif...Show more
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2016-9404
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.
CVE-2016-9403
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.
CVE-2016-9402
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-8977
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
CVE-2015-8976
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vecto...Show more
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."Show less
CVE-2015-8975
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web scr...Show more
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2015-8974
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
10.0 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execu...Show more
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.Show less
CVE-2015-8973
1Mybb
2Merge System
Mybb
May 13, 2026
Jan 31, 2017
N/A· v4
8.3 HIGH· v3
7.5 HIGH· v2
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
CVE-2015-4552
1Mybb
1Mybb
May 6, 2026
Sep 3, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
CVE-2015-2786
1Mybb
1Mybb
May 6, 2026
Mar 29, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
CVE-2015-2352
1Mybb
1Mybb
May 6, 2026
Mar 19, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors.
CVE-2015-2335
1Mybb
1Mybb
May 6, 2026
Mar 18, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.
CVE-2015-2334
1Mybb
1Mybb
May 6, 2026
Mar 18, 2015
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown ve...Show more
Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.Show less
CVE-2015-2333
1Mybb
1Mybb
May 6, 2026
Mar 18, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.