Read the docs

mybb

Records174All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical14CVSS 9.0–10.0
CVSS high47CVSS 7.0–8.9

Exploited now

mybb records in CISA KEV

No mybb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mybb 140 records HIGH Merge System 24 records MEDIUM Active Threads 1 record MEDIUM Ajax Forum Stat 1 record LOW Ban List 1 record LOW Delete Account 1 record MEDIUM Devbb 1 record LOW Last User Threads 1 record MEDIUM

Records

174 records

TI-2011-04621 CVE-2011-10018 · GHSA-4whv-mhhp-7qcj

myBB 1.6.4 Backdoor Arbitrary Command Execution

Priority HIGH 82

myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.03024 Published 2025-08-13 No fix listed CWE-912
TI-2022-08548 CVE-2022-24734

Remote code execution in mybb

Priority HIGH 73

MyBB is a free and open source forum software.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.77827 Published 2022-03-09 Fixed in 1.8.30 CWE-94
TI-2021-22547 CVE-2021-47934 · GHSA-9cv3-xr79-r4jw

MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF

Priority HIGH 70

MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00232 Published 2026-05-16 No fix listed CWE-79
TI-2018-15534 CVE-2018-25309 · GHSA-gcf4-8qvj-pjm9

MyBB Recent threads 17.0 Persistent Cross-Site Scripting

Priority MEDIUM 62

MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with crafted subject lines.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00261 Published 2026-04-29 No fix listed CWE-79
TI-2018-15475 CVE-2018-25250 · GHSA-8grq-4hc4-mrpv

MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS

Priority MEDIUM 62

MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00209 Published 2026-04-04 No fix listed CWE-79
TI-2024-35275 CVE-2024-52702 · GHSA-2hrg-xmqp-9q4v

A stored cross-site scripting (XSS) vulnerability in the component install\index.php of…

Priority MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name paramete…

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00273 Published 2024-11-20 No fix listed CWE-79
TI-2021-22519 CVE-2021-47905 · GHSA-wj7p-g6rj-6gf9

MyBB Delete Account Plugin 1.4 - Cross-Site Scripting

Priority MEDIUM 56

MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00247 Published 2026-01-23 No fix listed CWE-79
TI-2018-15474 CVE-2018-25249 · GHSA-4mc8-7jpg-4r7r

MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

Priority MEDIUM 56

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00264 Published 2026-04-04 No fix listed CWE-79
TI-2018-15473 CVE-2018-25248 · GHSA-8mwv-4frr-pwqr

MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php

Priority MEDIUM 56

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00234 Published 2026-04-04 No fix listed CWE-79
TI-2018-15358 CVE-2018-25132 · GHSA-6wmh-3ww6-g2h7

MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting

Priority MEDIUM 56

MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00247 Published 2026-01-23 No fix listed CWE-79
TI-2018-15342 CVE-2018-25116 · GHSA-x6j8-jwx9-2739

MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting

Priority MEDIUM 56

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00316 Published 2026-01-23 No fix listed CWE-79
Load more
Open these records in search →