MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add cr…
Medium CVSS 6.4
Summary
MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://community.mybb.com/mods.php?action=view&pid=411
Sources
- NVD DATABASE
Original Links
- https://community.mybb.com/mods.php?action=view&pid=411 Product
- https://www.exploit-db.com/exploits/44186 Exploit
- https://www.vulncheck.com/advisories/mybb-my-arcade-plugin-persistent-xss-via-comment Third Party Advisory
Timeline
- nvd_ingest NVD