CVE-2018-25247: MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles
MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25247?
CVE-2018-25247 is categorized as a cross-site scripting vulnerability which can potentially lead to the execution of malicious scripts on affected systems.
How do I fix CVE-2018-25247?
To mitigate CVE-2018-25247, update your MyBB Like Plugin to a version that addresses this vulnerability and ensure proper validation of user inputs.
Who is affected by CVE-2018-25247?
CVE-2018-25247 affects users of MyBB Like Plugin version 3.0.0, specifically those utilizing the plugin for forums.
What type of vulnerability is CVE-2018-25247?
CVE-2018-25247 is a cross-site scripting (XSS) vulnerability that allows attackers to inject scripts through unvalidated content.
What can attackers achieve with CVE-2018-25247?
Attackers exploiting CVE-2018-25247 can execute arbitrary scripts in the context of a user's session, potentially leading to data theft or account compromise.