Description

Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.

Remediation

References

CVE-2014-1840

Related Vulnerabilities

WordPress Plugin Metform Elementor Contact Form Builder-Flexible and Design-Friendly Contact Form builder for WordPress Information Disclosure (2.1.3)

Oracle Database Server Improper Input Validation Vulnerability (CVE-2018-1000873)

WordPress Plugin Disclosure Policy 'abspath' Parameter Remote File Include (1.0)

WordPress Plugin WP Symposium Open Redirect (13.12)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-27914)

Severity

Medium

Classification

CVE-2014-1840 CWE-707

Tags

Missing Update Known Vulnerabilities