CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-48941 – MyBB may disclosure unviewable threads' titles in searches
https://notcve.org/view.php?id=CVE-2025-48941
02 Jun 2025 — MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displ... • https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193 • CWE-1230: Exposure of Sensitive Information Through Metadata •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-48940 – MyBB's upgrade component vulnerable to local file inclusion
https://notcve.org/view.php?id=CVE-2025-48940
02 Jun 2025 — MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authentic... • https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-29459
https://notcve.org/view.php?id=CVE-2025-29459
17 Apr 2025 — An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation. Un problema en MyBB 1.8.38 permite que un atacante remoto obtenga información confidencial a través de la función Correo. • https://docs.mybb.com/1.8/administration/security/protection/#limit-access-to-private-hosts-and-ip-addresses • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23749 – WordPress mybb Last Topics plugin <= 1.0 - CSRF to Stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2025-23749
16 Jan 2025 — Cross-Site Request Forgery (CSRF) vulnerability in Mahdi Khaksar mybb Last Topics allows Stored XSS.This issue affects mybb Last Topics: from n/a through 1.0. The mybb Last Topics plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site ... • https://patchstack.com/database/wordpress/plugin/mybb-last-topics/vulnerability/wordpress-mybb-last-topics-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23335 – Backups directory .htaccess deletion in. MyBB
https://notcve.org/view.php?id=CVE-2024-23335
01 May 2024 — MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability MyBB es un software de foro gratuito y de código abierto. • https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23336 – Incomplete disallowed remote addresses list in MyBB
https://notcve.org/view.php?id=CVE-2024-23336
01 May 2024 — MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the exis... • https://docs.mybb.com/1.8/administration/configuration-file • CWE-184: Incomplete List of Disallowed Inputs CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46251 – Visual editor persistent Cross-site Scripting (XSS) in MyBB
https://notcve.org/view.php?id=CVE-2023-46251
06 Nov 2023 — MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously s... • https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45556
https://notcve.org/view.php?id=CVE-2023-45556
06 Nov 2023 — Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Vulnerabilidad de Cross-Site Scripting (XSS) en Mybb Mybb Forums v.1.8.33 permite a un atacante local ejecutar código arbitrario a través del parámetro Nombre del tema en el componente de administración de temas. • https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22612
https://notcve.org/view.php?id=CVE-2020-22612
01 Sep 2023 — Installer RCE on settings file write in MyBB before 1.8.22. Instalador RCE en el archivo de configuración de escritura en MyBB antes de 1.8.22. • https://mybb.com/versions/1.8.22 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 17%CPEs: 1EXPL: 1CVE-2023-41362
https://notcve.org/view.php?id=CVE-2023-41362
29 Aug 2023 — MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. MyBB anterior a 1.8.36 permite la inyección de código por parte de usuarios con ciertos privilegios elevados. Las plantillas en Admin CP usan intencionalmente eval, y hubo cierta validación de la entrada para eval, pero el malabarismo de tipos interfirió con esto cua... • https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE • CWE-94: Improper Control of Generation of Code ('Code Injection') •