CVE-2018-14724

In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page.

CVSS v3.0

5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 50th percentile

Published

2019-03-18

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/46347

References

• CVE Record
• NVD entry

Related

• CVE-2018-14716
• CVE-2018-14728
• CVE-2018-14714
• CVE-2018-14729
• CVE-2018-14713
• CVE-2018-14731