Skip to content
CVE Tracker
Back

CVE-2015-2149

Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote…

Low3.5EPSS 1.6%
Published
Updated
Reserved
Assigned by
mitre

Description

Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.

Scores

CVSS scores of CVE-2015-2149, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified2.0Low3.5AV:N/AC:M/Au:S/C:N/I:P/A:N
EPSS (exploitation in 30 days)
1.6% · top 24% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

Affected products

  • n/a

    • affected n/a

References (7)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .