PT-2026-30369 · Undefined · Undefined

Publicado 2026-04-04 · Atualizado 2026-04-04 · CVE-2018-25249

NVD

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-25249

Produtos afetados

Undefined

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25249 · Nota de Segurança
• https://vulncheck.com/advisories/mybb-my-arcade-plugin-persistent-xss-via-comment · Nota
• https://exploit-db.com/exploits/44186 · Nota
• https://community.mybb.com/mods.php?action=view&pid=411 · Nota