Vulnerabilities > Mybb > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-06-15 | CVE-2019-12830 | Cross-site Scripting vulnerability in Mybb In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue. | 8.7 |
| 2019-03-21 | CVE-2018-14575 | Cross-site Scripting vulnerability in Mybb Trash BIN 1.1.3 Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject. | 8.8 |
| 2018-06-26 | CVE-2018-1000502 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mybb MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. | 7.2 |
| 2017-04-06 | CVE-2017-7566 | Server-Side Request Forgery (SSRF) vulnerability in Mybb MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. | 7.7 |
| 2017-01-31 | CVE-2016-9418 | Information Exposure vulnerability in Mybb Merge System and Mybb MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name. | 7.5 |
| 2017-01-31 | CVE-2016-9417 | Server-Side Request Forgery (SSRF) vulnerability in Mybb Merge System and Mybb The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors. | 7.4 |
| 2017-01-31 | CVE-2016-9415 | Improper Access Control vulnerability in Mybb Merge System and Mybb MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import." | 7.5 |
| 2017-01-31 | CVE-2016-9414 | Information Exposure vulnerability in Mybb MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories. | 7.5 |
| 2017-01-31 | CVE-2016-9410 | Information Exposure vulnerability in Mybb MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates. | 7.5 |
| 2017-01-31 | CVE-2015-8977 | Information Exposure Through Log Files vulnerability in Mybb Merge System and Mybb MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files. | 7.5 |