Description
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Remediation
References
Related Vulnerabilities
MySQL CVE-2023-22066 Vulnerability (CVE-2023-22066)
WordPress Plugin Gallery Categories by BestWebSoft Cross-Site Scripting (1.0.8)
Jenkins URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2026-53437)
phpMyAdmin Other Vulnerability (CVE-2004-2632)
GlassFish Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-3250)