CVE-2022-39265

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392669.8isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 CVE-2022-392678.8Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for productio CVE-2022-392688.1### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may CVE-2022-392699.1PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch CVE-2022-39279.8The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification.CVE-2022-392705.4DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categorie CVE-2022-392717.5Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential CVE-2022-392724.3Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Use CVE-2022-392737.5FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without ch CVE-2022-392749.8LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable CVE-2022-392754.3Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input wh CVE-2022-392765.3GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service