mybb vulnerabilities and fixes

Recent CVEs affecting mybb, with upgrade or downgrade steps. 12 tracked.

mybb has 12 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-12-22. Highest priority: CVE-2011-10018 (score 69/100).

• CVE-2025-48941 MEDIUM 5.3 UPGRADE MyBB is free and open source forum software
• CVE-2025-48940 HIGH 7.2 UPGRADE MyBB is free and open source forum software
• CVE-2025-29460 HIGH 7.6 DOWNGRADE An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function
• CVE-2025-29459 HIGH 7.6 DOWNGRADE An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function
• CVE-2025-29458 HIGH 7.6 DOWNGRADE An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar functio
• CVE-2025-29457 HIGH 7.6 DOWNGRADE An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme functi
• CVE-2024-52702 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows at
• CVE-2023-53979 HIGH 8.8 DOWNGRADE MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload
• CVE-2023-53978 MEDIUM 5.4 DOWNGRADE myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that
• CVE-2023-53977 MEDIUM 5.4 DOWNGRADE myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that al
• CVE-2023-53976 MEDIUM 5.4 DOWNGRADE myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that
• CVE-2011-10018 CRITICAL 9.8 DOWNGRADE myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code

FAQ

How do I fix mybb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mybb being exploited right now?

None of the tracked mybb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mybb CVE should I patch first?

CVE-2011-10018 currently ranks highest (69/100): myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code.

RSS feed for mybb · ← Back to latest CVEs