CVE-2026-45115— MyBB: Buddy/ignore list username XSS
Possible ATT&CK Techniques 1AI
T1059.007 · JavaScriptGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45115
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MyBB: Buddy/ignore list username XSS
Source: CVE Program / CVE List V5
Vulnerability Description
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
MyBB 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MyBB是MyBB组织开源的一套用PHP和MySQL开发的免费且基于Web的论坛软件。该软件具有简单易用、支持多国语言、可扩展等特点。 MyBB 1.8.40之前版本存在跨站脚本漏洞，该漏洞源于Buddy/Ignore组件未正确清理用户名，可能导致特制用户名触发JavaScript代码注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45115
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7941 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-45115
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45115 (1)
- 🔗 Release mybb_1840 · mybb/mybb · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-45115 (1)
- 🔗 Buddy/ignore list username XSS · Advisory · mybb/mybb · GitHub Read full article x_refsource_CONFIRM
Vendor Pages for CVE-2026-45115 (1)
Same Patch Batch · mybb · 2026-08-18 · 18 CVEs total
| CVE-2026-45117 | 9.8 CRITICAL | MyBB: Installer database configuration RCE |
| CVE-2026-45118 | 9.3 CRITICAL | MyBB: Contact page reflected XSS |
| CVE-2026-45116 | 8.7 HIGH | MyBB: Profile field type confusion XSS |
| CVE-2026-45120 | 5.4 MEDIUM | MyBB: Insufficient authorization for private calendar events |
| CVE-2026-46482 | 5.3 MEDIUM | MyBB: Security Question insufficient validation |
| CVE-2026-45125 | 5.3 MEDIUM | MyBB: Email User CRLF injection |
| CVE-2026-45734 | 5.3 MEDIUM | MyBB: Default CAPTCHA missing invalidation |
| CVE-2026-45119 | 4.6 MEDIUM | MyBB: ACP UTF-8 Conversion CSRF |
| CVE-2026-45129 | 4.6 MEDIUM | MyBB: ACP Recovery Codes CSRF |
| CVE-2026-45123 | 4.3 MEDIUM | MyBB: IPv6 SSRF |
| CVE-2026-47245 | 4.3 MEDIUM | MyBB: Buddy list corruption |
| CVE-2026-45124 | 4.3 MEDIUM | MyBB: Mod CP report resolution missing authorization |
| CVE-2026-45122 | 4.3 MEDIUM | MyBB: Insufficient permission check for calendar event move |
| CVE-2026-45121 | 4.3 MEDIUM | MyBB: Insufficient permission check for calendar select |
| CVE-2026-45127 | 3.5 LOW | MyBB: ACP Mass Mail draft resend CSRF |
| CVE-2026-45126 | 3.5 LOW | MyBB: ACP Questions state CSRF |
| CVE-2026-45128 | 3.5 LOW | MyBB: ACP Users View Manager default CSRF |
IV. Related Vulnerabilities
Same product: mybb
Same vendor: mybb
Same weakness: CWE-79
- CVE-2026-78060
SourceCodester Stock Management System getOrderReport.php cr - CVE-2026-78059
SourceCodester Stock Management System printOrder.php cross - CVE-2026-78055
SourceCodester Class and Exam Timetabling System BSIT2.php c - CVE-2026-78054
SourceCodester Class and Exam Timetabling System BSIS1.php c - CVE-2026-77027
Joomla Extension - fabrikar.com - Unauthenticated stored XSS
V. Comments for CVE-2026-45115
No comments yet