Description

The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.

Remediation

References

CVE-2016-9411

Related Vulnerabilities

Drupal Core 4.6.x Cross-Site Scripting (4.6.0 - 4.6.8)

TCExam Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2021-20113)

Opencart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-10596)

Next.js Server-Side Request Forgery (SSRF) Vulnerability (CVE-2024-34351)

Pega Infinity Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2026-1564)

Severity

Medium

Classification

CVE-2016-9411 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities