# cve.now: Mybb

The newest entries naming Mybb as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-45118](https://cve.now/CVE-2026-45118.md): MyBB: Contact page reflected XSS (CVSS 9.3)
- [CVE-2026-45117](https://cve.now/CVE-2026-45117.md): MyBB: Installer database configuration RCE (CVSS 9.8)
- [CVE-2026-45129](https://cve.now/CVE-2026-45129.md): MyBB: ACP Recovery Codes CSRF (CVSS 4.6)
- [CVE-2026-45124](https://cve.now/CVE-2026-45124.md): MyBB: Mod CP report resolution missing authorization (CVSS 4.3)
- [CVE-2026-45120](https://cve.now/CVE-2026-45120.md): MyBB: Insufficient authorization for private calendar events (CVSS 5.4)
- [CVE-2026-47245](https://cve.now/CVE-2026-47245.md): MyBB: Buddy list corruption (CVSS 4.3)
- [CVE-2026-45734](https://cve.now/CVE-2026-45734.md): MyBB: Default CAPTCHA missing invalidation (CVSS 5.3)
- [CVE-2026-45125](https://cve.now/CVE-2026-45125.md): MyBB: Email User CRLF injection (CVSS 5.3)
- [CVE-2026-45122](https://cve.now/CVE-2026-45122.md): MyBB: Insufficient permission check for calendar event move (CVSS 4.3)
- [CVE-2026-45119](https://cve.now/CVE-2026-45119.md): MyBB: ACP UTF-8 Conversion CSRF (CVSS 4.6)
- [CVE-2026-45126](https://cve.now/CVE-2026-45126.md): MyBB: ACP Questions state CSRF (CVSS 3.5)
- [CVE-2026-45116](https://cve.now/CVE-2026-45116.md): MyBB: Profile field type confusion XSS (CVSS 8.7)
- [CVE-2026-45115](https://cve.now/CVE-2026-45115.md): MyBB: Buddy/ignore list username XSS (CVSS 8.7)
- [CVE-2026-45121](https://cve.now/CVE-2026-45121.md): MyBB: Insufficient permission check for calendar select (CVSS 4.3)
- [CVE-2026-46482](https://cve.now/CVE-2026-46482.md): MyBB: Security Question insufficient validation (CVSS 5.3)
- [CVE-2026-45123](https://cve.now/CVE-2026-45123.md): MyBB: IPv6 SSRF (CVSS 4.3)
- [CVE-2026-45128](https://cve.now/CVE-2026-45128.md): MyBB: ACP Users View Manager default CSRF (CVSS 3.5)
- [CVE-2026-45127](https://cve.now/CVE-2026-45127.md): MyBB: ACP Mass Mail draft resend CSRF (CVSS 3.5)
- [CVE-2021-47934](https://cve.now/CVE-2021-47934.md): MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF (CVSS 6.9)
- [CVE-2018-25309](https://cve.now/CVE-2018-25309.md): MyBB Recent threads 17.0 Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2018-25250](https://cve.now/CVE-2018-25250.md): MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS (CVSS 5.1)
- [CVE-2018-25249](https://cve.now/CVE-2018-25249.md): MyBB My Arcade Plugin 1.3 Persistent XSS via Comment (CVSS 5.1)
- [CVE-2018-25248](https://cve.now/CVE-2018-25248.md): MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php (CVSS 5.1)
- [CVE-2018-25247](https://cve.now/CVE-2018-25247.md): MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles (CVSS 5.1)
- [CVE-2023-53979](https://cve.now/CVE-2023-53979.md): MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities (CVSS 8.6)
- [CVE-2023-53978](https://cve.now/CVE-2023-53978.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements (CVSS 5.1)
- [CVE-2023-53977](https://cve.now/CVE-2023-53977.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management (CVSS 5.1)
- [CVE-2023-53976](https://cve.now/CVE-2023-53976.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management (CVSS 5.1)
- [CVE-2025-48941](https://cve.now/CVE-2025-48941.md): MyBB may disclosure unviewable threads' titles in searches (CVSS 5.3)
- [CVE-2025-48940](https://cve.now/CVE-2025-48940.md): MyBB's upgrade component vulnerable to local file inclusion (CVSS 7.2)
- [CVE-2024-23335](https://cve.now/CVE-2024-23335.md): Backups directory .htaccess deletion in. MyBB (CVSS 4.7)
- [CVE-2024-23336](https://cve.now/CVE-2024-23336.md): Incomplete disallowed remote addresses list in MyBB (CVSS 5.0)
- [CVE-2023-46251](https://cve.now/CVE-2023-46251.md): Visual editor persistent Cross-site Scripting (XSS) in MyBB (CVSS 7.5)
- [CVE-2022-39265](https://cve.now/CVE-2022-39265.md): Mail settings' command parameter injection in mybb (CVSS 7.2)
- [CVE-2022-24734](https://cve.now/CVE-2022-24734.md): Remote code execution in mybb (CVSS 7.2)
- [CVE-2020-15139](https://cve.now/CVE-2020-15139.md): XSS in MyBB (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mybb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.