CVE-2026-45115
HighCVSS 8.7Summary
MyBB before version 1.8.40 has a JavaScript code injection vulnerability in the Buddy/Ignore component due to improper username sanitization. Specially crafted usernames can leave unescaped single quotes, which can be exploited to execute scripts.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks within the application context.
Recommendation
Upgrade MyBB to version 1.8.40 or later, which includes the fix.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.