Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MyBB — Vulnerabilities & Security Advisories 36

Browse all 36 CVE security advisories affecting MyBB. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MyBB serves as a free, open-source forum software platform enabling online community discussions. Historically, it has been susceptible to multiple vulnerability classes, including remote code execution (RCE), cross-site scripting (XSS), and privilege escalation, contributing to its 17 recorded CVEs. While no major public security incidents have been widely documented, the software's persistent vulnerability history suggests a need for rigorous patch management and security hardening. Its PHP-based architecture and extensive customization options may introduce additional attack surfaces if not properly maintained. Regular updates and secure configuration remain critical for mitigating risks associated with this platform.

Found 27 results / 36 Clear Filters
CVE ID Title CVSS Severity Published
CVE-2026-45118 MyBB: Contact page reflected XSS — mybb CWE-83 9.3 Critical 2026-08-18
CVE-2026-45117 MyBB: Installer database configuration RCE — mybb CWE-94 9.8 Critical 2026-08-18
CVE-2026-45129 MyBB: ACP Recovery Codes CSRF — mybb CWE-352 4.6 Medium 2026-08-18
CVE-2026-45124 MyBB: Mod CP report resolution missing authorization — mybb CWE-862 4.3 Medium 2026-08-18
CVE-2026-45120 MyBB: Insufficient authorization for private calendar events — mybb CWE-639 5.4 Medium 2026-08-18
CVE-2026-47245 MyBB: Buddy list corruption — mybb CWE-252 4.3 Medium 2026-08-18
CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation — mybb CWE-837 5.3 Medium 2026-08-18
CVE-2026-45125 MyBB: Email User CRLF injection — mybb CWE-93 5.3 Medium 2026-08-18
CVE-2026-45122 MyBB: Insufficient permission check for calendar event move — mybb CWE-863 4.3 Medium 2026-08-18
CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF — mybb CWE-352 4.6 Medium 2026-08-18
CVE-2026-45126 MyBB: ACP Questions state CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2026-45116 MyBB: Profile field type confusion XSS — mybb CWE-79 8.7 High 2026-08-18
CVE-2026-45115 MyBB: Buddy/ignore list username XSS — mybb CWE-79 8.7 High 2026-08-18
CVE-2026-45121 MyBB: Insufficient permission check for calendar select — mybb CWE-863 4.3 Medium 2026-08-18
CVE-2026-46482 MyBB: Security Question insufficient validation — mybb CWE-636 5.3 Medium 2026-08-18
CVE-2026-45123 MyBB: IPv6 SSRF — mybb CWE-918 4.3 Medium 2026-08-18
CVE-2026-45128 MyBB: ACP Users View Manager default CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF — mybb CWE-352 3.5 Low 2026-08-18
CVE-2023-53979 MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities — MyBB CWE-22 8.8 High 2025-12-22
CVE-2025-48941 MyBB may disclosure unviewable threads' titles in searches — mybb CWE-1230 5.3 Medium 2025-06-02
CVE-2025-48940 MyBB's upgrade component vulnerable to local file inclusion — mybb CWE-22 7.2 High 2025-06-02
CVE-2024-23335 Backups directory .htaccess deletion in. MyBB — mybb CWE-20 4.7 Medium 2024-05-01
CVE-2024-23336 Incomplete disallowed remote addresses list in MyBB — mybb CWE-918 5.0 Medium 2024-05-01
CVE-2023-46251 Visual editor persistent Cross-site Scripting (XSS) in MyBB — mybb CWE-79 7.5 High 2023-11-06
CVE-2022-39265 Mail settings' command parameter injection in mybb — mybb CWE-74 7.2 High 2022-10-06
CVE-2022-24734 Remote code execution in mybb — mybb CWE-94 7.2 High 2022-03-09
CVE-2020-15139 XSS in MyBB — MyBB CWE-79 8.8 High 2020-08-10

This page lists every published CVE security advisory associated with MyBB. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.