CVE-2018-25309

HIGH

7.2

Description

MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with crafted subject lines. Attackers can create threads with script tags in the subject parameter to execute arbitrary JavaScript in the browsers of all users viewing the index page.

Details CVE

Score CVSS v3.17.2

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie4/29/2026

Derniere modification5/1/2026

Sourcenvd

Observations honeypot0

Produits affectes

dragonexpert:recent_threads_on_index

Faiblesses (CWE)

CWE-79

References

https://community.mybb.com/mods.php?action=view&pid=191(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/44420(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/mybb-recent-threads-persistent-cross-site-scripting(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.