MyBB Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2015-2149 - Vulnerability Database

MyBB

MyBB Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2015-2149

Low

Reference: CVE-2015-2149

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2015-2149

Title: MyBB Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php (5) name field in an add_set action in the style-templates module to admin/index.php (6) title field in an add_template_group action in the style-templates module to admin/index.php (7) name field in an add action in the config-post_icons module to admin/index.php (8) quottitle to assignquot field in an add action in the user-titles module to admin/index.php or (9) username field in the config-banning module to admin/index.php.