CVE Vulnerability Catalog

MyBB before version 1.8.40 in the Email User controller does not sanitize sender names correctly, resulting in mail header injection. The fromname parameter is accepted without sanitization, and when mail_handler is set to the default PHP mail value, the sender name is used in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences.

MyBB before version 1.8.40 in the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts, and when no forums are in scope, the UPDATE query executes without the expected permission-based limitation.

MyBB before version 1.8.40 in the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses, and verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result for IPv6, allowing a crafted remote target to bypass the host restriction.

MyBB before version 1.8.40 in the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar.

Prior to version 1.8.40, the calendar module in MyBB does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the calendar module in MyBB does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the Admin CP UTF-8 Conversion module in MyBB does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. This issue is fixed in version 1.8.40.

The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

The Gravity Booster – Styles & Layouts for Gravity Forms plugin version 6.0 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

The RomethemeForm For Elementor plugin version 1.2.6 and earlier has a broken access control vulnerability exploitable by Contributor users. This means a contributor can gain unauthorized access to functions they should not have permissions for.

The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.

Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.

The MasterStudy LMS plugin version 3.7.41 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

The Flutterwave WooCommerce plugin version 3.3.0 and earlier has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.