Description

xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.

Remediation

References

CVE-2015-8973

Related Vulnerabilities

WordPress Plugin Postie Multiple Vulnerabilities (1.9.40)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-6727)

WordPress Plugin One Click SSL Cross-Site Request Forgery (1.4.6)

WordPress Plugin Font-official webfonts plugin of Fonts For Web Cross-Site Scripting (7.5.1)

Jenkins Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-21686)

Severity

High

Classification

CVE-2015-8973 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities