CVE-2018-11092

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.mybb.com/mods.php?action=changelog&pid=1106Release Notes, Third Party Advisory
https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=splitPatch, Third Party Advisory
https://www.exploit-db.com/exploits/44624/Exploit, Third Party Advisory, VDB Entry
https://community.mybb.com/mods.php?action=changelog&pid=1106Release Notes, Third Party Advisory
https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=splitPatch, Third Party Advisory
https://www.exploit-db.com/exploits/44624/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-110936.1Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web sc CVE-2018-110949.8An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /gofor CVE-2018-110958.8The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the CVE-2018-110966.5Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account infor CVE-2018-110977.5An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.CVE-2018-110987.2An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar is CVE-2018-110995.5The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-base CVE-2018-11107.5A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.CVE-2018-111008.8The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than CVE-2018-111016.1Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or CVE-2018-111027.5An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cau CVE-2018-111056.1There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "emai