CVE-2021-43281

7.2 highEPSS 1.3%

High (7.2) in mybb mybb. EPSS 1.3% chance of exploitation in the next 30 days.

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-11-01)
CWE: CWE-94
Published: 2021-11-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mybb:mybb

References

https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p
https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p

Check your stack JSON