CVE-2016-9415
HighSummary
MyBB before version 1.8.8 on Windows and MyBB Merge System before version 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to 'style import.'
Risk Assessment
Attackers can exploit this vulnerability to modify the appearance of the site, potentially leading to fraud or malicious actions against users.
Recommendation
It is recommended to update MyBB to version 1.8.8 or later to mitigate this threat.
Other vulnerabilities in MyBB, MyBB Merge System
See all- CVE-2016-9418High
MyBB before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
- CVE-2016-9417High
The fetch_remote_file function in MyBB before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9414High
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
- CVE-2016-9410High
MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
- CVE-2015-8977High
MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
- CVE-2016-9420Critical
MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.
- CVE-2016-9412Critical
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.
Original NVD description (English source)
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."