Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MyBB — Vulnerabilities & Security Advisories 36

Browse all 36 CVE security advisories affecting MyBB. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MyBB serves as a free, open-source forum software platform enabling online community discussions. Historically, it has been susceptible to multiple vulnerability classes, including remote code execution (RCE), cross-site scripting (XSS), and privilege escalation, contributing to its 17 recorded CVEs. While no major public security incidents have been widely documented, the software's persistent vulnerability history suggests a need for rigorous patch management and security hardening. Its PHP-based architecture and extensive customization options may introduce additional attack surfaces if not properly maintained. Regular updates and secure configuration remain critical for mitigating risks associated with this platform.

CVE ID Title CVSS Severity Published
CVE-2026-45118 MyBB: Contact page reflected XSS — mybb CWE-83 9.3 Critical 2026-08-18
CVE-2026-45117 MyBB: Installer database configuration RCE — mybb CWE-94 9.8 Critical 2026-08-18
CVE-2026-45129 MyBB: ACP Recovery Codes CSRF — mybb CWE-352 4.6 Medium 2026-08-18
CVE-2026-45124 MyBB: Mod CP report resolution missing authorization — mybb CWE-862 4.3 Medium 2026-08-18
CVE-2026-45120 MyBB: Insufficient authorization for private calendar events — mybb CWE-639 5.4 Medium 2026-08-18
CVE-2026-47245 MyBB: Buddy list corruption — mybb CWE-252 4.3 Medium 2026-08-18
CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation — mybb CWE-837 5.3 Medium 2026-08-18
CVE-2026-45125 MyBB: Email User CRLF injection — mybb CWE-93 5.3 Medium 2026-08-18
CVE-2026-45122 MyBB: Insufficient permission check for calendar event move — mybb CWE-863 4.3 Medium 2026-08-18
CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF — mybb CWE-352 4.6 Medium 2026-08-18
CVE-2026-45126 MyBB: ACP Questions state CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2026-45116 MyBB: Profile field type confusion XSS — mybb CWE-79 8.7 High 2026-08-18
CVE-2026-45115 MyBB: Buddy/ignore list username XSS — mybb CWE-79 8.7 High 2026-08-18
CVE-2026-45121 MyBB: Insufficient permission check for calendar select — mybb CWE-863 4.3 Medium 2026-08-18
CVE-2026-46482 MyBB: Security Question insufficient validation — mybb CWE-636 5.3 Medium 2026-08-18
CVE-2026-45123 MyBB: IPv6 SSRF — mybb CWE-918 4.3 Medium 2026-08-18
CVE-2026-45128 MyBB: ACP Users View Manager default CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2021-47934 MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF — MyBB Timeline Plugin CWE-79 5.3 Medium 2026-05-16
CVE-2018-25309 MyBB Recent threads 17.0 Persistent Cross-Site Scripting — MyBB Recent threads CWE-79 7.2 High 2026-04-29
CVE-2018-25250 MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS — MyBB Last User's Threads in Profile Plugin CWE-79 7.2 High 2026-04-04
CVE-2018-25249 MyBB My Arcade Plugin 1.3 Persistent XSS via Comment — MyBB My Arcade Plugin CWE-79 6.4 Medium 2026-04-04
CVE-2018-25248 MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php — MyBB Downloads Plugin CWE-79 7.2 High 2026-04-04
CVE-2018-25247 MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles — MyBB Like Plugin CWE-79 6.1 Medium 2026-04-04
CVE-2023-53978 myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements — myBB forums CWE-79 5.4 Medium 2025-12-22
CVE-2023-53979 MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities — MyBB CWE-22 8.8 High 2025-12-22
CVE-2023-53977 myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management — myBB forums CWE-79 5.4 Medium 2025-12-22
CVE-2023-53976 myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management — myBB forums CWE-79 5.4 Medium 2025-12-22
CVE-2025-48941 MyBB may disclosure unviewable threads' titles in searches — mybb CWE-1230 5.3 Medium 2025-06-02
CVE-2025-48940 MyBB's upgrade component vulnerable to local file inclusion — mybb CWE-22 7.2 High 2025-06-02

This page lists every published CVE security advisory associated with MyBB. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.