Mybb
118 CVEs across 23 Mybb products. Browse Mybb vulnerabilities, severities, and proof-of-concept exploits.
Mybb products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47934 | Medium | 5.3 | 2026-05-16 | MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, an… |
CVE-2018-25309 | High | 7.2 | 2026-04-29 | MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with cr… |
CVE-2018-25250 | High | 7.2 | 2026-04-04 | MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by cr… |
CVE-2018-25249 | Medium | 6.4 | 2026-04-04 | MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade g… |
CVE-2018-25248 | High | 7.2 | 2026-04-04 | MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the downlo… |
CVE-2018-25247 | Medium | 6.1 | 2026-04-04 | MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; w… |
CVE-2021-47905 | Medium | 6.1 | 2026-01-23 | MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field. Attackers can inject malicious scripts… |
CVE-2018-25132 | Medium | 6.1 | 2026-01-23 | MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attacker… |
CVE-2018-25116 | Medium | 6.1 | 2026-01-23 | MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malic… |
CVE-2023-53979 | High | 8.8 | 2025-12-22 | MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attacker… |
CVE-2023-53978 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject mal… |
CVE-2023-53977 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malic… |
CVE-2023-53976 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject ma… |
CVE-2011-10018 | Critical | 9.8 | 2025-08-13 | myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP co… |
CVE-2025-48941 | Medium | 5.3 | 2025-06-02 | MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to d… |
CVE-2025-48940 | High | 7.2 | 2025-06-02 | MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to pe… |
CVE-2025-29460 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the a… |
CVE-2025-29459 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed… |
CVE-2025-29458 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of th… |
CVE-2025-29457 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of t… |
CVE-2024-52702 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-23336 | Medium | 5.0 | 2024-05-01 | MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Serv… |
CVE-2024-23335 | Medium | 4.7 | 2024-05-01 | MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted… |
CVE-2023-45556 | Medium | 5.4 | 2023-11-06 | Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme man… |
CVE-2023-46251 | High | 7.5 | 2023-11-06 | MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, re… |
CVE-2020-22612 | Critical | 9.8 | 2023-09-01 | Installer RCE on settings file write in MyBB before 1.8.22. |
CVE-2023-41362 | High | 7.2 | 2023-08-29 | MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of… |
CVE-2023-28467 | Medium | 6.1 | 2023-05-22 | In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. |
CVE-2022-28354 | Medium | 6.1 | 2023-04-24 | In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. |
CVE-2022-45867 | High | 7.2 | 2023-01-03 | MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inc… |
CVE-2022-43709 | Medium | 4.9 | 2022-11-22 | MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input… |
CVE-2022-43708 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the… |
CVE-2022-43707 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stor… |
CVE-2022-39265 | High | 7.2 | 2022-10-06 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connecti… |
CVE-2022-24734 | High | 7.2 | 2022-03-09 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on inse… |
CVE-2021-43281 | High | 7.2 | 2021-11-04 | MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not vali… |
CVE-2021-41866 | Medium | 5.4 | 2021-10-26 | MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. |
CVE-2020-19049 | Medium | 5.4 | 2021-08-31 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New For… |
CVE-2020-19048 | Medium | 5.4 | 2021-08-31 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" pa… |
CVE-2021-27949 | Medium | 6.1 | 2021-03-15 | Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. |
CVE-2021-27948 | High | 7.2 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). |
CVE-2021-27947 | High | 7.2 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). |
CVE-2021-27946 | High | 8.8 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3). |
CVE-2021-27890 | High | 8.8 | 2021-03-15 | SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. |
CVE-2021-27889 | Medium | 6.1 | 2021-03-15 | Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. |
CVE-2021-27279 | Medium | 5.4 | 2021-02-22 | MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). |
CVE-2020-15139 | High | 8.8 | 2020-08-10 | In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS… |
CVE-2014-3827 | Medium | 5.4 | 2020-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web scr… |
CVE-2014-3826 | Medium | 5.4 | 2020-02-11 | Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter… |
CVE-2019-20225 | Medium | 6.1 | 2020-01-02 | MyBB before 1.8.22 allows an open redirect on login. |
CVE-2019-12831 | High | 7.2 | 2019-06-15 | In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database… |
CVE-2019-12830 | High | 8.7 | 2019-06-15 | In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over a… |
CVE-2019-3579 | Medium | 5.3 | 2019-06-06 | MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the co… |
CVE-2019-3578 | Medium | 6.1 | 2019-06-06 | MyBB 1.8.19 has XSS in the resetpassword function. |
CVE-2018-19202 | Medium | 6.1 | 2019-04-11 | A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter. |
CVE-2018-19201 | Medium | 6.1 | 2019-03-29 | A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter. |
CVE-2018-14724 | Medium | 5.4 | 2019-03-21 | In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the ba… |
CVE-2018-14575 | High | 8.8 | 2019-03-21 | Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject. |
CVE-2018-17128 | Medium | 5.4 | 2018-09-17 | A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. |
CVE-2018-15596 | Medium | 6.1 | 2018-08-28 | An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/synd… |
CVE-2018-14392 | Medium | 6.1 | 2018-07-19 | The New Threads plugin before 1.2 for MyBB has XSS. |
CVE-2018-1000503 | Medium | 4.3 | 2018-06-26 | MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having… |
CVE-2018-1000502 | High | 7.2 | 2018-06-26 | MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local… |
CVE-2018-10678 | Medium | 6.1 | 2018-05-13 | MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduc… |
CVE-2018-7305 | Medium | 4.9 | 2018-02-21 | MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. |
CVE-2018-6844 | Medium | 5.4 | 2018-02-08 | MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. |
CVE-2017-16781 | Medium | 5.4 | 2017-11-10 | The installer in MyBB before 1.8.13 has XSS. |
CVE-2017-16780 | Critical | 9.8 | 2017-11-10 | The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. |
CVE-2017-8104 | Medium | 5.3 | 2017-04-24 | In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. |
CVE-2017-8103 | Medium | 6.1 | 2017-04-24 | In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. |
CVE-2017-7566 | High | 7.7 | 2017-04-06 | MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. |
CVE-2016-9421 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before… |
CVE-2016-9420 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comp… |
CVE-2016-9419 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote… |
CVE-2016-9418 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information f… |
CVE-2016-9417 | High | 7.4 | 2017-01-31 | The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side req… |
CVE-2016-9416 | Critical | 9.8 | 2017-01-31 | SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to… |
CVE-2016-9415 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via ve… |
CVE-2016-9414 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directo… |
CVE-2016-9413 | Medium | 6.5 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks v… |
CVE-2016-9412 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and s… |
CVE-2016-9411 | Medium | 5.3 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path v… |
CVE-2016-9410 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors in… |
CVE-2016-9409 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow r… |
CVE-2016-9408 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow rem… |
CVE-2016-9407 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject a… |
CVE-2016-9406 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow re… |
CVE-2016-9405 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote… |
CVE-2016-9404 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject a… |
CVE-2016-9403 | Critical | 9.8 | 2017-01-31 | newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a m… |
CVE-2016-9402 | Critical | 9.8 | 2017-01-31 | SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers t… |
CVE-2015-8977 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via v… |
CVE-2015-8976 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remo… |
CVE-2015-8975 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1… |
CVE-2015-8974 | Critical | 10.0 | 2017-01-31 | SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and My… |
CVE-2015-8973 | High | 8.3 | 2017-01-31 | xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended ac… |
CVE-2015-4552 | | 2015-09-03 | Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject… | |
CVE-2015-2786 | | 2015-03-29 | Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong grou… | |
CVE-2015-2352 | | 2015-03-19 | The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers t… | |
CVE-2015-2335 | | 2015-03-18 | A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors. |