Mybb vulnerabilities
36 CVEs and advisories name Mybb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45118MyBB: Contact page reflected XSS
- CVE-2026-45117MyBB: Installer database configuration RCE
- CVE-2026-45129MyBB: ACP Recovery Codes CSRF
- CVE-2026-45124MyBB: Mod CP report resolution missing authorization
- CVE-2026-45120MyBB: Insufficient authorization for private calendar events
- CVE-2026-47245MyBB: Buddy list corruption
- CVE-2026-45734MyBB: Default CAPTCHA missing invalidation
- CVE-2026-45125MyBB: Email User CRLF injection
- CVE-2026-45122MyBB: Insufficient permission check for calendar event move
- CVE-2026-45119MyBB: ACP UTF-8 Conversion CSRF
- CVE-2026-45126MyBB: ACP Questions state CSRF
- CVE-2026-45116MyBB: Profile field type confusion XSS
- CVE-2026-45115MyBB: Buddy/ignore list username XSS
- CVE-2026-45121MyBB: Insufficient permission check for calendar select
- CVE-2026-46482MyBB: Security Question insufficient validation
- CVE-2026-45123MyBB: IPv6 SSRF
- CVE-2026-45128MyBB: ACP Users View Manager default CSRF
- CVE-2026-45127MyBB: ACP Mass Mail draft resend CSRF
- CVE-2021-47934MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF
- CVE-2018-25309MyBB Recent threads 17.0 Persistent Cross-Site Scripting
- CVE-2018-25250MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS
- CVE-2018-25249MyBB My Arcade Plugin 1.3 Persistent XSS via Comment
- CVE-2018-25248MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php
- CVE-2018-25247MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles
- CVE-2023-53979MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
- CVE-2023-53978myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements
- CVE-2023-53977myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management
- CVE-2023-53976myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management
- CVE-2025-48941MyBB may disclosure unviewable threads' titles in searches
- CVE-2025-48940MyBB's upgrade component vulnerable to local file inclusion