CVSS: 8.8EPSS: 1%CPEs: 22EXPL: 3CVE-2009-2230 – MyBB 1.4.6 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2230
26 Jun 2009 — SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter. Vulnerabilidad de inyección SQL en inc/datahandlers/user.php en MyBB (alias MyBulletinBoard) antes de v1.4.7 permite a atacantes remotos autenticados ejecutar comandos SQL de su elección a través del parámetro birthdayprivacy . • https://www.exploit-db.com/exploits/9001 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 25EXPL: 3CVE-2008-0787 – MyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0787
15 Feb 2008 — SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the options[disablesmilies] parameter to private.php. Vulnerabilidad de inyección de SQL en inc/datahandlers/pm.php en MyBB anterior a v1.2.12, permite a usuarios autentificados remotamente ejecutar comandos SQL de su eleccion a través del parámetro "options"[disablesmilies] del private.php • https://www.exploit-db.com/exploits/5070 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 73%CPEs: 19EXPL: 2CVE-2008-0382 – MyBulletinBoard (MyBB) 1.2.10 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2008-0382
22 Jan 2008 — Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php. Múltiples vulnerabilidades de inyección eval en MyBB 1.2.10 y anteriores permite a atacantes remotos ejecutar código de su elección a través de un parámetro sortby en las acciones (1) forumdisplay.php o (2)results en search.php. • https://www.exploit-db.com/exploits/4927 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2007-2211 – MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2007-2211
24 Apr 2007 — SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a dayview action. Vulnerabilidad de inyección SQL en calendar.php en MyBB (aka MyBulletinBoard) 1.2.5 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro day en una acción dayview. • https://www.exploit-db.com/exploits/3780 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2007-1963 – MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2007-1963
11 Apr 2007 — SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775. Vulnerabilidad de inyección SQL en la función create_session en class_session.php de MyBB (también conocido como MyBulletinBoard) 1.2.3 y anteriores permite a atacantes remotos ejecutar comandos sql de su elección mediante la cabecera ... • https://www.exploit-db.com/exploits/3653 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2005-1832
https://notcve.org/view.php?id=CVE-2005-1832
31 May 2005 — Multiple cross-site scripting (XSS) vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 and earlier allow remote attackers to execute arbitrary web script or HTML via the (1) forums, (2) version, or (3) limit parameter to misc.php, (4) page or (5) datecut parameter to forumdisplay.php, (6) username, (7) email, or (8) email2 parameter to member.php, (9) page or (10) usersearch parameter to memberlist.php, (11) pid or (12) tid parameter to showthread.php, or (13) tid parameter to printthread.php. • http://marc.info/?l=bugtraq&m=111757191118050&w=2 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 3CVE-2005-1833 – MyBulletinBoard (MyBB) 1.00 RC4 - 'calendar.php' SQL Injection
https://notcve.org/view.php?id=CVE-2005-1833
31 May 2005 — Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to calendar.php, (2) idsql parameter to online.php, (3) usersearch parameter to memberlist.php, (4) pid parameter to editpost.php, (5) fid parameter to forumdisplay.php, (6) tid parameter to newreply.php, (7) sid parameter to search.php, (8) tid or (9) pid parameter to showthread.php, (10) tid parameter to usercp2.php, (11) tid parameter to printthread.... • https://www.exploit-db.com/exploits/1022 •