CVE-2021-27279

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mybb/mybb/commit/cb781b49116bf5c4d8deca3e17498122b701677aPatch, Third Party Advisory
https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75wExploit, Third Party Advisory
https://mybb.com/versions/1.8.25/Release Notes, Vendor Advisory
https://github.com/mybb/mybb/commit/cb781b49116bf5c4d8deca3e17498122b701677aPatch, Third Party Advisory
https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75wExploit, Third Party Advisory
https://mybb.com/versions/1.8.25/Release Notes, Vendor Advisory

Timeline

Published: Feb 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-272807.8OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.CVE-2021-272858.4An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands CVE-2021-272886.1Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script CVE-2021-272899.1A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = CVE-2021-272907.5ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could CVE-2021-272917.5In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular ex CVE-2021-272927.5ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a maliciou CVE-2021-272937.5RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when convertin CVE-2021-273067.5An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authentic CVE-2021-273084.8A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via CVE-2021-273096.1Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.CVE-2021-273106.1Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.