CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2015-2149
https://notcve.org/view.php?id=CVE-2015-2149
18 Mar 2015 — Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks modu... • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2332
https://notcve.org/view.php?id=CVE-2015-2332
18 Mar 2015 — Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en member.php en MyBB (también conocido como MyBulletinBoard) anterior a 1.8.4 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2333
https://notcve.org/view.php?id=CVE-2015-2333
18 Mar 2015 — Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en el editor MyCode en MyBB (también conocido como MyBulletinBoard) anterior a 1.8.4 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2334
https://notcve.org/view.php?id=CVE-2015-2334
18 Mar 2015 — Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad de CSRF en el inicio de sesión de Admin Control Panel (ACP) en MyBB (también conocido como MyBulletinBoard) anterior a 1.8.4 permite a atacantes remotos secuestrar la autenticación de victimas no especificadas a través de vectores desconocidos. • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2335
https://notcve.org/view.php?id=CVE-2015-2335
18 Mar 2015 — A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors. Una libraría JSON en MyBB (también conocido como MyBulletinBoard) anterior a 1.8.4 permite a atacantes remotos obtener la ruta de instalación a través de vectores desconocidos. • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 2CVE-2014-9240 – MyBB 1.8.x - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-9240
03 Dec 2014 — SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action. Vulnerabilidad de inyección SQL en member.php en MyBB (también conocido como MyBulletinBoard) 1.8.x anterior a 1.8.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro question_id en una acción do_register. • https://www.exploit-db.com/exploits/35224 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 2EXPL: 2CVE-2014-9241 – MyBB 1.8.x - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-9241
03 Dec 2014 — Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php, (2) signature parameter in a do_editsig action to usercp.php, or (3) title parameter in the style-templates module in an edit_template action or (4) file parameter in the config-languages module in an edit action to admin/index.php. Múltiples vulnerabilidades de XSS en MyBB (también conocido como MyBulleti... • https://www.exploit-db.com/exploits/35224 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2014-5248
https://notcve.org/view.php?id=CVE-2014-5248
14 Aug 2014 — Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode. Vulnerabilidad de XSS en MyBB anterior a 1.6.15 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a traves de vectores relacionados con video MyCode. • http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 3CVE-2014-1840 – MyBB 1.6.12 POST Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-1840
03 Feb 2014 — Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. Vulnerabilidad de XSS en Upload/search.php en MyBB 1.6.12 y anteriores permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro keywords en una acción do_search, que no es manejado debidamente en un mensaje de error ... • https://packetstorm.news/files/id/125038 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 0CVE-2013-7288
https://notcve.org/view.php?id=CVE-2013-7288
10 Jan 2014 — Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs. Vulnerabilidad cross-site scripting (XSS) en la función mycode_parse_video de inc/class_parser.php de MyBB (MyBulletinBoard) anteriores a 1.6.12 permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través de vectores relacionados con URLs d... • http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •