medium5.4Public exploit code
CVE-2018-10580
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts witho…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting2018-05-10 · webapps · php
Impact
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Latest Posts On Profile Project | Latest Posts On Profile | Version 1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/147575/MyBB-Latest-Posts-On-Profile-1.1-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/44608/
- http://packetstormsecurity.com/files/147575/MyBB-Latest-Posts-On-Profile-1.1-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/44608/