CVEvulnerability
CVE-2015-8975
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-01-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected configurations
• mybb merge system 1.8.5
• mybb mybb (<= 1.6.17)
• mybb mybb 1.8.0
• mybb mybb 1.8.1
• mybb mybb 1.8.2
• mybb mybb 1.8.3
• mybb mybb 1.8.4
• mybb mybb 1.8.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 Third Party Advisory, VDB Entry
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 Third Party Advisory, VDB Entry
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory