CVE-2014-3826: XSS
Published Feb 11, 2020
·Updated
Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module.
Affected Software
1 affected component
Mybb Mybb<1.6.13
Event History
Feb 11, 2020
CVE Published
via MITRE·06:48 PM
Data Sourced
via MITRE·06:48 PM
Description
Frequently Asked Questions
1
What is the CVE ID of the vulnerability?
The CVE ID of the vulnerability is CVE-2014-3826.
2
What is the severity of CVE-2014-3826?
The severity of CVE-2014-3826 is medium with a CVSS score of 5.4.
3
How does CVE-2014-3826 affect MyBB?
CVE-2014-3826 affects MyBB versions up to and excluding 1.6.13.
4
How can a remote authenticated user exploit CVE-2014-3826?
A remote authenticated user can exploit CVE-2014-3826 by injecting arbitrary web scripts or HTML through the name parameter in the edit action of the config-profile_fields module.
5
Is there a proof of concept for CVE-2014-3826?
Yes, a proof of concept for CVE-2014-3826 is available at http://adamziaja.com/poc/201312-xss-mybb.html.