EIP-2026-109749

PRE-CVE

MyBulletinBoard (MyBB) 1.0.x/1.1.x - 'usercp.php' SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-109749. PoCs published by imei.

AI-analyzed exploit summary The exploit demonstrates an SQL injection vulnerability in MyBulletinBoard (MyBB) by injecting malicious input into the 'action' parameter of usercp.php. The payload manipulates the 'additionalgroups' parameter to potentially elevate privileges or access unauthorized data.

Description

MyBulletinBoard (MyBB) 1.0.x/1.1.x - 'usercp.php' SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED
by imei · textwebappsphp
https://www.exploit-db.com/exploits/28092

The exploit demonstrates an SQL injection vulnerability in MyBulletinBoard (MyBB) by injecting malicious input into the 'action' parameter of usercp.php. The payload manipulates the 'additionalgroups' parameter to potentially elevate privileges or access unauthorized data.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: MyBulletinBoard (MyBB)
Auth required
Prerequisites: User authentication to access usercp.php
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026