CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23749 – WordPress mybb Last Topics plugin <= 1.0 - CSRF to Stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2025-23749
16 Jan 2025 — Cross-Site Request Forgery (CSRF) vulnerability in Mahdi Khaksar mybb Last Topics allows Stored XSS.This issue affects mybb Last Topics: from n/a through 1.0. The mybb Last Topics plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site ... • https://patchstack.com/database/wordpress/plugin/mybb-last-topics/vulnerability/wordpress-mybb-last-topics-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23335 – Backups directory .htaccess deletion in. MyBB
https://notcve.org/view.php?id=CVE-2024-23335
01 May 2024 — MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability MyBB es un software de foro gratuito y de código abierto. • https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23336 – Incomplete disallowed remote addresses list in MyBB
https://notcve.org/view.php?id=CVE-2024-23336
01 May 2024 — MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the exis... • https://docs.mybb.com/1.8/administration/configuration-file • CWE-184: Incomplete List of Disallowed Inputs CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46251 – Visual editor persistent Cross-site Scripting (XSS) in MyBB
https://notcve.org/view.php?id=CVE-2023-46251
06 Nov 2023 — MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously s... • https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45556
https://notcve.org/view.php?id=CVE-2023-45556
06 Nov 2023 — Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Vulnerabilidad de Cross-Site Scripting (XSS) en Mybb Mybb Forums v.1.8.33 permite a un atacante local ejecutar código arbitrario a través del parámetro Nombre del tema en el componente de administración de temas. • https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22612
https://notcve.org/view.php?id=CVE-2020-22612
01 Sep 2023 — Installer RCE on settings file write in MyBB before 1.8.22. Instalador RCE en el archivo de configuración de escritura en MyBB antes de 1.8.22. • https://mybb.com/versions/1.8.22 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 17%CPEs: 1EXPL: 1CVE-2023-41362
https://notcve.org/view.php?id=CVE-2023-41362
29 Aug 2023 — MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. MyBB anterior a 1.8.36 permite la inyección de código por parte de usuarios con ciertos privilegios elevados. Las plantillas en Admin CP usan intencionalmente eval, y hubo cierta validación de la entrada para eval, pero el malabarismo de tipos interfirió con esto cua... • https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28467
https://notcve.org/view.php?id=CVE-2023-28467
22 May 2023 — In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. • https://github.com/ahmetaltuntas/CVE-2023-28467 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 3%CPEs: 1EXPL: 0CVE-2022-45867
https://notcve.org/view.php?id=CVE-2022-45867
03 Jan 2023 — MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution. • https://github.com/mybb/mybb/security/advisories/GHSA-cpfv-6f8w-759r • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43707
https://notcve.org/view.php?id=CVE-2022-43707
21 Nov 2022 — MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data MyBB 1.8.31 tiene una vulnerabilidad de Cross-Site Scripting (XSS) en el editor visual MyCode (SCEditor) que permite a atacantes remotos inyectar HTML a través de la entrada del usuario o datos almacenados. • https://github.com/mybb/mybb/security/advisories/GHSA-6vpw-m83q-27px • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •