GCVE - cpe:2.3:a:mybboard:mybb:1.4.10:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mybboard:mybb:1.4.10:*:*:*:*:*:*:*

part: a version: 1.4.10 update: *

Vendor	Mybboard (`77ae3ac2-4413-5f09-80ae-e5ac370ea890`)
Product	Mybb (`b19a7865-6053-587d-a911-e97df28e110d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mybb/mybb`	purl2cpe	2026-06-01 10:12:16.838515

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-5096`	vulnerable	2026-06-08 04:56:32.172335	Details available Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error. Published: 2012-08-13T23:00:00.000Z Updated: 2024-09-17T04:10:28.021Z Open on db.gcve.eu Reference links http://www.osvdb.org/70014 http://dev.mybb.com/issues/1330 http://www.openwall.com/lists/oss-security/2012/05/08/7 http://www.osvdb.org/70013 http://www.securityfocus.com/bid/45565	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4813`	vulnerable	2026-06-08 04:51:50.016533	Details available Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action. Published: 2010-04-27T15:00:00.000Z Updated: 2024-08-07T07:17:25.551Z Open on db.gcve.eu Reference links http://secunia.com/advisories/37910 http://www.exploit-db.com/exploits/10622 http://www.securityfocus.com/bid/37464 http://osvdb.org/61298	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4449`	vulnerable	2026-06-08 04:51:48.550953	Details available Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php. Published: 2009-12-29T20:15:00.000Z Updated: 2024-08-07T07:01:20.338Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/37489 http://openwall.com/lists/oss-security/2010/10/08/7 http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php http://secunia.com/advisories/37906 http://openwall.com/lists/oss-security/2010/10/11/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4448`	vulnerable	2026-06-08 04:51:48.549326	Details available inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors. Published: 2009-12-29T20:15:00.000Z Updated: 2024-08-07T07:01:20.701Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2010/10/08/7 http://secunia.com/advisories/37906 http://openwall.com/lists/oss-security/2010/10/11/8 http://openwall.com/lists/oss-security/2010/12/06/2 http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.