Skip to content
CVE Tracker
Back

CVE-2011-10018

myBB 1.6.4 Backdoor Arbitrary Command Execution

Critical10.0EPSS 3.0%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.

Scores

CVSS scores of CVE-2011-10018, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Critical10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Analyzed4.0Critical10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
3.0% · top 13% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

Affected products

  • myBB Group · Forum Software

    • affected 1.6.4

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .