CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43707
https://notcve.org/view.php?id=CVE-2022-43707
21 Nov 2022 — MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data MyBB 1.8.31 tiene una vulnerabilidad de Cross-Site Scripting (XSS) en el editor visual MyCode (SCEditor) que permite a atacantes remotos inyectar HTML a través de la entrada del usuario o datos almacenados. • https://github.com/mybb/mybb/security/advisories/GHSA-6vpw-m83q-27px • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43708
https://notcve.org/view.php?id=CVE-2022-43708
21 Nov 2022 — MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name MyBB 1.8.31 tiene (problema 2 de 2) vulnerabilidades de Cross-Site Scripting (XSS) en la interfaz de archivos adjuntos que permite a los atacantes inyectar HTML persuadiendo al usuario a cargar un archivo con un nombre especialmente manipulado. • https://github.com/mybb/mybb/security/advisories/GHSA-p9m7-9qv4-x93w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43709
https://notcve.org/view.php?id=CVE-2022-43709
21 Nov 2022 — MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. MyBB 1.8.31 tiene una vulnerabilidad de inyección SQL en el módulo Usuarios del Admin CP que permite a los usuarios remotos autenticados modificar la cadena de consulta mediante la entrada directa del usuario o la configuración del filtro de búsqueda almacenada. • https://github.com/mybb/mybb/security/advisories/GHSA-ggp5-454p-867v • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 1%CPEs: 1EXPL: 1CVE-2022-39265 – Mail settings' command parameter injection in mybb
https://notcve.org/view.php?id=CVE-2022-39265
06 Oct 2022 — MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. • https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.2EPSS: 85%CPEs: 1EXPL: 7CVE-2022-24734 – Remote code execution in mybb
https://notcve.org/view.php?id=CVE-2022-24734
09 Mar 2022 — MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. • https://packetstorm.news/files/id/167082 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43281
https://notcve.org/view.php?id=CVE-2021-43281
04 Nov 2021 — MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages. MyBB versiones anteriores a 1.8.29, permite una Inyección de Código Remota por parte de un administrador con el permiso "Can manage settings?". El módulo de administración de configuraciones... • https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41866
https://notcve.org/view.php?id=CVE-2021-41866
26 Oct 2021 — MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. MyBB versiones anteriores a 1.8.28, permite un ataque de tipo XSS almacenado porque el valor del Nombre de la Plantilla que se muestra en la administración de temas del CP de Administración no escapa apropiadamente • https://github.com/mybb/mybb/security/advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39338 – MyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-39338
14 Oct 2021 — The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El plugin MyBB Cross-Poster de WordPress ... • https://github.com/BigTiger2020/word-press/blob/main/MyBB%20Cross-Poster.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19049
https://notcve.org/view.php?id=CVE-2020-19049
31 Aug 2021 — Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en MyBB versión v1.8.20, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del campo "Description" que se encuentra en la página "Add New Forum" haciendo u... • https://github.com/joelister/bug/issues/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19048
https://notcve.org/view.php?id=CVE-2020-19048
31 Aug 2021 — Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en MyBB versión v1.8.20, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del campo "Title" que se encuentra en la página "Add New Forum" haciendo una petición ... • https://github.com/joelister/bug/issues/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •