CVE-2023-41362

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-413634.3In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.CVE-2023-413649.8In tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.CVE-2023-413654.3SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct theCVE-2023-413665.3Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERCVE-2023-413675.3Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can CVE-2023-413685.3The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbookCVE-2023-413694.3The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload thCVE-2023-413727.8The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client CVE-2023-413739.9A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands CVE-2023-413747.8Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user opCVE-2023-413757.8Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user opeCVE-2023-413767.5Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP p
CVE-2023-41362: High severity, CVSS 7.2 | Vulnix