The host is running MyBB and is prone to multiple cross-site scripting vulnerabilities.

Successful exploitation will allow attackers to inject arbitrary web script or HTML. Impact Level: Application

Upgrade to MyBB version 1.6.1 or later, For updates refer to http://www.mybb.com/downloads

The flaws are caused by improper validation of user-supplied input via vectors related to 'editpost.php', 'member.php', and 'newreply.php'.

MyBB 1.6 and prior.

• http://blog.mybb.com/2010/12/15/mybb-1-6-1-release-1-4-14-update/
• http://openwall.com/lists/oss-security/2010/12/20/1
• http://openwall.com/lists/oss-security/2010/12/22/2
• http://yehg.net/lab/pr0js/advisories/[mybb1.6]_cross_site_scripting

---

Updated on 2015-03-25