CVE-2016-9410
HighSummary
MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
Risk Assessment
Attackers may gain access to confidential data, potentially leading to serious security breaches and loss of user trust.
Recommendation
It is recommended to update MyBB and MyBB Merge System to version 1.8.7 or later to mitigate this vulnerability.
Other vulnerabilities in MyBB, MyBB Merge System
See all- CVE-2016-9418High
MyBB before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
- CVE-2016-9417High
The fetch_remote_file function in MyBB before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9415High
MyBB before version 1.8.8 on Windows and MyBB Merge System before version 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to 'style import.'
- CVE-2016-9414High
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
- CVE-2015-8977High
MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
- CVE-2016-9420Critical
MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.
- CVE-2016-9412Critical
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.
Original NVD description (English source)
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.