CVEs we hold for Mybb

Records whose assigning authority named Mybb as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-47245MyBB: Buddy list corruptionmybb

CVE-2026-46482MyBB: Security Question insufficient validationmybb

CVE-2026-45734MyBB: Default CAPTCHA missing invalidationmybb

CVE-2026-45129MyBB: ACP Recovery Codes CSRFmybb

CVE-2026-45128MyBB: ACP Users View Manager default CSRFmybb

CVE-2026-45127MyBB: ACP Mass Mail draft resend CSRFmybb

CVE-2026-45126MyBB: ACP Questions state CSRFmybb

CVE-2026-45125MyBB: Email User CRLF injectionmybb

CVE-2026-45124MyBB: Mod CP report resolution missing authorizationmybb

CVE-2026-45123MyBB: IPv6 SSRFmybb

CVE-2026-45122MyBB: Insufficient permission check for calendar event movemybb

CVE-2026-45121MyBB: Insufficient permission check for calendar selectmybb

CVE-2026-45120MyBB: Insufficient authorization for private calendar eventsmybb

CVE-2026-45119MyBB: ACP UTF-8 Conversion CSRFmybb

CVE-2026-45118MyBB: Contact page reflected XSSmybb

CVE-2026-45117MyBB: Installer database configuration RCEmybb

CVE-2026-45116MyBB: Profile field type confusion XSSmybb

CVE-2026-45115MyBB: Buddy/ignore list username XSSmybb

CVE-2025-48941MyBB may disclosure unviewable threads' titles in searchesmybb

CVE-2025-48940MyBB's upgrade component vulnerable to local file inclusionmybb

CVE-2024-23336Incomplete disallowed remote addresses list in MyBBmybb

CVE-2024-23335Backups directory .htaccess deletion in. MyBBmybb

CVE-2023-53979MyBB 1.8.32 Authenticated Remote Code Execution via Chained VulnerabilitiesMyBB

CVE-2023-53978myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum AnnouncementsmyBB forums

CVE-2023-53977myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum ManagementmyBB forums

CVE-2023-53976myBB Forums 1.8.26 Stored Cross-Site Scripting via Template ManagementmyBB forums

CVE-2023-46251Visual editor persistent Cross-site Scripting (XSS) in MyBBmybb

CVE-2022-39265Mail settings' command parameter injection in mybbmybb

CVE-2022-24734Remote code execution in mybbmybb

CVE-2021-47934MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRFMyBB Timeline Plugin

CVE-2021-39338MyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site ScriptingMyBB Cross-Poster

CVE-2020-15139XSS in MyBBMyBB

CVE-2018-25309MyBB Recent threads 17.0 Persistent Cross-Site ScriptingMyBB Recent threads

CVE-2018-25250MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSSMyBB Last User's Threads in Profile Plugin

CVE-2018-25249MyBB My Arcade Plugin 1.3 Persistent XSS via CommentMyBB My Arcade Plugin

CVE-2018-25248MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.phpMyBB Downloads Plugin

CVE-2018-25247MyBB Like Plugin 3.0.0 Cross-Site Scripting via User ProfilesMyBB Like Plugin

CVE-2011-10018myBB 1.6.4 Backdoor Arbitrary Command ExecutionmyBB Group Forum Software

38 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.