MyBB vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20222
3. 20231
4. 20242
5. 20256
6. 202624

Newest CVEs

• CVE-2026-45118

  MyBB: Contact page reflected XSS

  mybb · mybb

  Critical9.3
• CVE-2026-45117

  MyBB: Installer database configuration RCE

  mybb · mybb

  Critical9.8
• CVE-2026-45129

  MyBB: ACP Recovery Codes CSRF

  mybb · mybb

  Medium4.6
• CVE-2026-45124

  MyBB: Mod CP report resolution missing authorization

  mybb · mybb

  Medium4.3
• CVE-2026-45120

  MyBB: Insufficient authorization for private calendar events

  mybb · mybb

  Medium5.4
• CVE-2026-47245

  MyBB: Buddy list corruption

  mybb · mybb

  Medium4.3
• CVE-2026-45734

  MyBB: Default CAPTCHA missing invalidation

  mybb · mybb

  Medium5.3
• CVE-2026-45125

  MyBB: Email User CRLF injection

  mybb · mybb

  Medium5.3
• CVE-2026-45122

  MyBB: Insufficient permission check for calendar event move

  mybb · mybb

  Medium4.3
• CVE-2026-45119

  MyBB: ACP UTF-8 Conversion CSRF

  mybb · mybb

  Medium4.6