Vulnerabilities (CVE)

Filtered by vendor Mybulletinboard Subscribe
Total 63 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2006-2949 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 6.8 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter.
CVE-2006-0494 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 4.3 MEDIUM N/A
Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.
CVE-2005-3778 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.0 MEDIUM N/A
Unspecified vulnerability in MyBulletinBoard (MyBB) before 1.0 PR2 Rev 686 allows attackers to cause a denial of service via unknown vectors.
CVE-2006-4707 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 6.8 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).
CVE-2005-2888 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 7.5 HIGH N/A
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter to misc.php or (2) Content-Disposition field in the HTTP header to newreply.php.
CVE-2005-3777 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.0 MEDIUM N/A
MyBulletinBoard (MyBB) 1.0 PR2 Rev 686 allows remote attackers to delete or move private messages (PM) via modified fields in the inbox form.
CVE-2006-0523 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 7.5 HIGH N/A
SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.
CVE-2005-1811 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in usercp.php for MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via the website field in a user profile.
CVE-2006-0638 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 6.5 MEDIUM N/A
SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.
CVE-2006-1717 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.1 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in newthread.php in MyBB (aka MyBulletinBoard) 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username.
CVE-2006-3761 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javascript".
CVE-2006-4706 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 6.8 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using "java& #115;cript," a different vulnerability than CVE-2006-3761.
CVE-2006-2103 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 2.1 LOW N/A
SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2) setid, (3) expand, (4) title, or (5) sid2 parameters to (b) admin/templates.php.
CVE-2006-2336 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 6.4 MEDIUM N/A
SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.
CVE-2006-1281 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 3.5 LOW N/A
Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.
CVE-2005-2697 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 7.5 HIGH N/A
SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282.
CVE-2006-3759 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.0 MEDIUM N/A
Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."
CVE-2005-0282 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 7.5 HIGH N/A
SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the uid parameter.
CVE-2006-4449 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.1 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.
CVE-2006-1912 1 Mybulletinboard 1 Mybulletinboard 2024-02-28 5.8 MEDIUM N/A
MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL injection attacks.