CVE-2023-53977mediumCWE-79

CVE-2023-53977: medium-severity vulnerability in myBB forums

myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management

Published · Updated

Follow this CVE+ Monitor myBB forums

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
In short

myBB Forums 1.8.26 has a vulnerability where administrators can accidentally (or maliciously) insert harmful scripts into forum names through the admin panel. When other users view the forum list, these scripts run in their browsers, potentially stealing data or performing unwanted actions.

Technical detail

Stored XSS vulnerability in the forum management interface (CWE-79) affecting myBB 1.8.26. Authenticated administrators can inject malicious JavaScript via the forum title field in the 'Forums and Posts' > 'Forum Management' section. The payload persists in the database and executes in the context of users viewing forum listings, bypassing input sanitization on the backend.

Summary generated and translated by AI from the official description.
myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums through the 'Forums and Posts' > 'Forum Management' interface, causing arbitrary JavaScript to execute when the forum listing is viewed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Mybb · myBB forums
Related CVEs — myBB forums

In the same product, most dangerous first.

CVE-2023-53976MEDIUMmyBB Forums 1.8.26 Stored Cross-Site Scripting via Template ManagementEPSS 0.2%CVE-2023-53978MEDIUMmyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum AnnouncementsEPSS 0.2%