CVE-2018-11092

MEDIUM

Admin Notes 1.1 - Cross-Site Request Forgery via Clear Table Action

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-11092. PoCs published by 0xB9.

AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in the MyBB Admin Notes Plugin version 1.1, allowing an attacker to remotely delete all admin notes via a crafted HTML page. The PoC uses a simple img tag to trigger the deletion without user interaction.

Description

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.

Exploits (1)

exploitdb WORKING POC
by 0xB9 · textwebappsphp
https://www.exploit-db.com/exploits/44624

This exploit demonstrates a CSRF vulnerability in the MyBB Admin Notes Plugin version 1.1, allowing an attacker to remotely delete all admin notes via a crafted HTML page. The PoC uses a simple img tag to trigger the deletion without user interaction.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: MyBB Admin Notes Plugin 1.1
No auth needed
Prerequisites: Victim must be authenticated as an admin and visit the malicious page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://community.mybb.com/mods.php?action=changelog&pid=1106
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44624/

Scores

CVSS v3 6.5
EPSS 0.0102
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-352
Status published
Products (1)
admin_notes_project/admin_notes 1.1
Published May 21, 2018
Tracked Since Feb 18, 2026