CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23335 – Backups directory .htaccess deletion in. MyBB
https://notcve.org/view.php?id=CVE-2024-23335
01 May 2024 — MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability MyBB es un software de foro gratuito y de código abierto. • https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23336 – Incomplete disallowed remote addresses list in MyBB
https://notcve.org/view.php?id=CVE-2024-23336
01 May 2024 — MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the exis... • https://docs.mybb.com/1.8/administration/configuration-file • CWE-184: Incomplete List of Disallowed Inputs CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46251 – Visual editor persistent Cross-site Scripting (XSS) in MyBB
https://notcve.org/view.php?id=CVE-2023-46251
06 Nov 2023 — MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously s... • https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45556
https://notcve.org/view.php?id=CVE-2023-45556
06 Nov 2023 — Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Vulnerabilidad de Cross-Site Scripting (XSS) en Mybb Mybb Forums v.1.8.33 permite a un atacante local ejecutar código arbitrario a través del parámetro Nombre del tema en el componente de administración de temas. • https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22612
https://notcve.org/view.php?id=CVE-2020-22612
01 Sep 2023 — Installer RCE on settings file write in MyBB before 1.8.22. Instalador RCE en el archivo de configuración de escritura en MyBB antes de 1.8.22. • https://mybb.com/versions/1.8.22 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-41362
https://notcve.org/view.php?id=CVE-2023-41362
29 Aug 2023 — MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. MyBB anterior a 1.8.36 permite la inyección de código por parte de usuarios con ciertos privilegios elevados. Las plantillas en Admin CP usan intencionalmente eval, y hubo cierta validación de la entrada para eval, pero el malabarismo de tipos interfirió con esto cua... • https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28467
https://notcve.org/view.php?id=CVE-2023-28467
22 May 2023 — In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. • https://github.com/ahmetaltuntas/CVE-2023-28467 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45867
https://notcve.org/view.php?id=CVE-2022-45867
03 Jan 2023 — MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution. • https://github.com/mybb/mybb/security/advisories/GHSA-cpfv-6f8w-759r • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43709
https://notcve.org/view.php?id=CVE-2022-43709
21 Nov 2022 — MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. MyBB 1.8.31 tiene una vulnerabilidad de inyección SQL en el módulo Usuarios del Admin CP que permite a los usuarios remotos autenticados modificar la cadena de consulta mediante la entrada directa del usuario o la configuración del filtro de búsqueda almacenada. • https://github.com/mybb/mybb/security/advisories/GHSA-ggp5-454p-867v • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43708
https://notcve.org/view.php?id=CVE-2022-43708
21 Nov 2022 — MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name MyBB 1.8.31 tiene (problema 2 de 2) vulnerabilidades de Cross-Site Scripting (XSS) en la interfaz de archivos adjuntos que permite a los atacantes inyectar HTML persuadiendo al usuario a cargar un archivo con un nombre especialmente manipulado. • https://github.com/mybb/mybb/security/advisories/GHSA-p9m7-9qv4-x93w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •