Vulnerabilities (CVE)

Filtered by vendor Mybb Subscribe
Filtered by product Mybb
Total 131 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2016-9419 1 Mybb 1 Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-8974 1 Mybb 2 Merge System, Mybb 2025-04-20 7.5 HIGH 10.0 CRITICAL
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2015-8975 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-9413 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.5 MEDIUM
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2016-9407 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.
CVE-2016-9421 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-16781 1 Mybb 1 Mybb 2025-04-20 3.5 LOW 5.4 MEDIUM
The installer in MyBB before 1.8.13 has XSS.
CVE-2017-8104 1 Mybb 1 Mybb 2025-04-20 5.0 MEDIUM 5.3 MEDIUM
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
CVE-2017-16780 1 Mybb 1 Mybb 2025-04-20 7.5 HIGH 9.8 CRITICAL
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.
CVE-2015-8976 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
CVE-2015-8977 1 Mybb 2 Merge System, Mybb 2025-04-20 5.0 MEDIUM 7.5 HIGH
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
CVE-2016-9414 1 Mybb 2 Merge System, Mybb 2025-04-20 5.0 MEDIUM 7.5 HIGH
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
CVE-2016-9417 1 Mybb 2 Merge System, Mybb 2025-04-20 5.8 MEDIUM 7.4 HIGH
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVE-2016-9410 1 Mybb 2 Merge System, Mybb 2025-04-20 5.0 MEDIUM 7.5 HIGH
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
CVE-2016-9415 2 Microsoft, Mybb 3 Windows, Merge System, Mybb 2025-04-20 5.0 MEDIUM 7.5 HIGH
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
CVE-2016-9409 1 Mybb 2 Merge System, Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
CVE-2017-8103 1 Mybb 1 Mybb 2025-04-20 4.3 MEDIUM 6.1 MEDIUM
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
CVE-2017-7566 1 Mybb 1 Mybb 2025-04-20 4.0 MEDIUM 7.7 HIGH
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
CVE-2016-9411 1 Mybb 2 Merge System, Mybb 2025-04-20 5.0 MEDIUM 5.3 MEDIUM
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.
CVE-2016-9420 1 Mybb 2 Merge System, Mybb 2025-04-20 7.5 HIGH 9.8 CRITICAL
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."