CVE-2023-53977

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums through the 'Forums and Posts' > 'Forum Management' interface, causing arbitrary JavaScript to execute when the forum listing is viewed.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-539785.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrCVE-2023-539798.8MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitCVE-2023-53985.9Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell SecurityCVE-2023-539809.8ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensCVE-2023-539817.2PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through tCVE-2023-539827.5PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulatCVE-2023-539839.8Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. AttaCVE-2023-539848.4Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged useCVE-2023-539856.1Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject maliciouCVE-2023-539868.6In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: disable RAC flush for TP1 RAC flush causes kerneCVE-2023-53987In the Linux kernel, the following vulnerability has been resolved: ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca15CVE-2023-539887.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() Here is a BUG