Mybulletinboard vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2009-2230 SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL cHigh 7.5 · Jun 26, 2009
• CVE-2008-0382 Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplayHigh 7.5 · Jan 22, 2008
• CVE-2007-2211 SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the daHigh 7.5 · Apr 24, 2007
• CVE-2006-3775 SQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrary SQL commaHigh 7.5 · Jul 24, 2006
• CVE-2006-3758 inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET variables, which alHigh 7.5 · Jul 21, 2006
• CVE-2006-3760 Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.High 7.5 · Jul 21, 2006
• CVE-2006-3420 Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions aHigh 7.5 · Jul 6, 2006
• CVE-2006-3243 SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodeHigh 7.5 · Jun 27, 2006
• CVE-2006-2908 The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP cHigh 7.5 · Jun 12, 2006
• CVE-2006-1974 SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameHigh 7.5 · Apr 21, 2006
• CVE-2006-0959 SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commaHigh 7.5 · Mar 2, 2006
• CVE-2006-0523 SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.High 7.5 · Feb 2, 2006
• CVE-2006-0219 The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allHigh 7.5 · Jan 16, 2006
• CVE-2005-4200 Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities than those High 10 · Dec 13, 2005
• CVE-2005-3326 SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.High 7.5 · Oct 27, 2005
• CVE-2005-2778 SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.High 7.5 · Sep 2, 2005
• CVE-2005-2697 SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commandHigh 7.5 · Aug 26, 2005
• CVE-2005-2580 Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the UHigh 7.5 · Aug 16, 2005
• CVE-2005-1833 Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to High 7.5 · May 31, 2005
• CVE-2005-0282 SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the uid parameter.High 7.5 · May 2, 2005