medium6.1Public exploit code
CVE-2021-27889
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyBB 1.8.25 - Chained Remote Command Execution2021-03-22 · webapps · php
Impact
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mybb | Mybb | before 1.8.26 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161908/MyBB-1.8.25-Remote-Command-Execution.html
- https://blog.sonarsource.com/mybb-remote-code-execution-chain
- https://github.com/mybb/mybb/security/advisories/GHSA-xhj7-3349-mqcm
- http://packetstormsecurity.com/files/161908/MyBB-1.8.25-Remote-Command-Execution.html
- https://blog.sonarsource.com/mybb-remote-code-execution-chain
- https://github.com/mybb/mybb/security/advisories/GHSA-xhj7-3349-mqcm