CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2014-5248
https://notcve.org/view.php?id=CVE-2014-5248
14 Aug 2014 — Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode. Vulnerabilidad de XSS en MyBB anterior a 1.6.15 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a traves de vectores relacionados con video MyCode. • http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 3CVE-2014-1840 – MyBB 1.6.12 POST Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-1840
03 Feb 2014 — Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. Vulnerabilidad de XSS en Upload/search.php en MyBB 1.6.12 y anteriores permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro keywords en una acción do_search, que no es manejado debidamente en un mensaje de error ... • https://packetstorm.news/files/id/125038 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 0CVE-2013-7288
https://notcve.org/view.php?id=CVE-2013-7288
10 Jan 2014 — Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs. Vulnerabilidad cross-site scripting (XSS) en la función mycode_parse_video de inc/class_parser.php de MyBB (MyBulletinBoard) anteriores a 1.6.12 permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través de vectores relacionados con URLs d... • http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 1CVE-2013-7275
https://notcve.org/view.php?id=CVE-2013-7275
08 Jan 2014 — Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup. Vulnerabilidad cross-site scripting (XSS) en misc.php de MyBB (tambien conocido como MyBulletinBoard) anteriores a 1.6.12 permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través del parámetro editor en un listado de smileis. • http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 50EXPL: 0CVE-2011-5133
https://notcve.org/view.php?id=CVE-2011-5133
30 Aug 2012 — Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list." Vulnerabilidad no especificada en MyBB anterior a v1.6.5 tiene un impacto desconocido y vectores de ataque también desconocidos, relacionados con un "avatar de usuario no parseado en una lista (buddy)". • http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release •
CVSS: 6.1EPSS: 0%CPEs: 50EXPL: 0CVE-2011-5132
https://notcve.org/view.php?id=CVE-2011-5132
30 Aug 2012 — Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX." Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en MyBB anterior a v1.6.5 permite a atacantes remotos inyectar código web o HTML arbitrario a través de vectores relacionados con nombres de usuarios a través de AJAX. • http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 50EXPL: 0CVE-2011-5131
https://notcve.org/view.php?id=CVE-2011-5131
30 Aug 2012 — Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter. Vulnerabilidad de solicitudes falsificadas en sitios cruzados (CSRF) en global.php en MyBB anterior a v1.6.5 permite a atacantes remotos secuestrar la autenticación de un usuario para solicitar un cambio de lenguaje del usuario a través del parámetro de lenguaje. • http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 60EXPL: 2CVE-2010-5096 – MyBB 1.6 - 'private.php?keywords' SQL Injection
https://notcve.org/view.php?id=CVE-2010-5096
13 Aug 2012 — Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error. ** EN DISPUTA ** Múltiples vulnerabilidades de inyección SQL en MyBB (también conocido como MyBulletinBoard) antes de v1.6.1 permit... • https://www.exploit-db.com/exploits/35141 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 62EXPL: 0CVE-2012-2324
https://notcve.org/view.php?id=CVE-2012-2324
13 Aug 2012 — Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP). Múltiples vulnerabilidades de inyección SQL en MyBB (alias MyBulletinBoard) antes de v1.6.7 permiten a los administradores remotos ejecutar comandos SQL a través de vectores no especificados en (1) la búsqueda de usuarios o (2) el registro de correo en el Panel de Contro... • http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 62EXPL: 0CVE-2012-2327
https://notcve.org/view.php?id=CVE-2012-2327
13 Aug 2012 — MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message. MyBB (también conocido como MyBulletinBoard) antes de v1.6.7 permite a atacantes remotos obtener información sensible a través de una cookie forumread incorrecta, lo cual revela la ruta de instalación en un mensaje de error. • http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •