Skip to content

Mybb · weakness class

SQL Injection

17 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
1

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

  1. SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.CVE-2021-27890Mybb · 11% likely

    CWE-89

  2. Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_s…CVE-2010-5096Mybb · 5.6% likely

    CWE-89

  3. SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).CVE-2021-27946Mybb · 4.2% likely

    CWE-89

  4. SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter…CVE-2014-9240Mybb · 3.5% likely

    CWE-89

  5. Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL comm…CVE-2013-6936Mybb · 2.5% likely

    CWE-89

  6. SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System befo…CVE-2015-8974Mybb · 2.1% likely

    CWE-89

  7. SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQ…CVE-2016-9416Mybb · 2.1% likely

    CWE-89

  8. SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary…CVE-2016-9402Mybb · 2.1% likely

    CWE-89

  9. Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year param…CVE-2005-4199Mybb · 2.1% likely

    CWE-89

  10. Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a…CVE-2008-0383Mybb · 1.5% likely

    CWE-89

  11. SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.CVE-2008-3965Mybb · 1.3% likely

    CWE-89

  12. SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergr…CVE-2012-5909Mybb · 1.1% likely

    CWE-89

  13. SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to execu…CVE-2012-2325Mybb · 1.0% likely

    CWE-89

  14. Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1)…CVE-2012-2324Mybb · 1.0% likely

    CWE-89

  15. SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).CVE-2021-27948Mybb · 1.0% likely

    CWE-89

  16. SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).CVE-2021-27947Mybb · 1.0% likely

    CWE-89

  17. Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQ…CVE-2008-3070Mybb · 0.9% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

Updated AboutDevelopersSign in