CVE-2020-19049

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p52

Published

Aug 31, 2021 (Aug 31, 2021)

Modified

Jun 17, 2026

Description

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.

Vendors: mybb
Products: mybb
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.