CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges

published August 29, 2023

CVSS
—
EPSS
2%
Percentile
81.1
In the wild
Unconfirmed
What it is

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02051 · 81.1th percentile
Published
2023-08-29T00:00Z
EPSS history
Timeline
  • 29 AUG 00:00Z
    MyBB before 1.8.36 allows Code Injection by users with certain high privileges
    cvelistv5