CVE-2025-29457

Summary

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://www.yuque.com/morysummer/vx41bz/vro4dvxzuiwlg6uv
• https://docs.mybb.com/1.8/administration/security/protection/#limit-access-to-private-hosts-and-ip-addresses

• ←Previous
• Next→