CVE-2016-9418

HIGH

Mybb Merge System < 1.8.7 - Information Disclosure

Title source: rule

Description

MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.

References (4)

[Mailing List, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/11/10/8

[Mailing List, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/11/18/1

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94396

[Patch, Release Notes, Vendor Advisory] https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/

Scores

CVSS v3 7.5

EPSS 0.0133

EPSS Percentile 79.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status draft

Affected Products (2)

mybb/merge_system < 1.8.7

mybb/mybb < 1.8.7

Timeline

Published Jan 31, 2017

Tracked Since Feb 18, 2026