CVE-2016-9412

CRITICAL

Mybb Merge System < 1.8.6 - Improper Access Control

Title source: rule

Description

MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.

References (4)

Scores

CVSS v3 9.8
EPSS 0.0285
EPSS Percentile 86.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-284
Status draft

Affected Products (2)

mybb/merge_system < 1.8.6
mybb/mybb < 1.8.6

Timeline

Published Jan 31, 2017
Tracked Since Feb 18, 2026