CVE-2021-43281

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission

published November 4, 2021

CVSS
—
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01335 · 70.9th percentile
Published
2021-11-04T17:42Z
EPSS history
Timeline
  • 04 NOV 17:42Z
    MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission
    cvelistv5