CVEvulnerability
CVE-2015-8976
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-01-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
Affected configurations
• mybb merge system 1.8.5
• mybb mybb (<= 1.6.17)
• mybb mybb 1.8.0
• mybb mybb 1.8.1
• mybb mybb 1.8.2
• mybb mybb 1.8.3
• mybb mybb 1.8.4
• mybb mybb 1.8.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 www.securityfocus.com
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 www.securityfocus.com
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory